Splunk Search

How to search for total number of buckets for an index and total sizeOnDiskMB for a specific state?

Path Finder


I am looking for a go-to search that will give me total number of buckets for an index for a specific state of a bucket and the total sizeOnDiskMB for this state. What would also be nice is if this could be at the bottom of a table for the index so I can see the location that all these buckets are stored. I can get the total of sizeOnDiskMB, but can't seem to add in the the total number of buckets as a row.

This is my current search

|dbinspect index=main state =warm splunk_server=*idx02* | eval size=sizeOnDiskMB/1024| addcoltotals | fillnull value="Total" | table index,path,size

any and all help would be great

0 Karma

Revered Legend

You need to use an appendpipe command, instead of addcoltotal which only does sum and only for numeric valued columns.

Give this a try

|dbinspect index=main state =warm splunk_server=*idx02* | eval size=sizeOnDiskMB/1024 | table index,path,size | appendpipe [| stats count(path) as path sum(size) as size | eval index="Total"]
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.