How to search for total number of buckets for an index and total sizeOnDiskMB for a specific state?

[jcspigler2010]

Hello,

I am looking for a go-to search that will give me total number of buckets for an index for a specific state of a bucket and the total sizeOnDiskMB for this state. What would also be nice is if this could be at the bottom of a table for the index so I can see the location that all these buckets are stored. I can get the total of sizeOnDiskMB, but can't seem to add in the the total number of buckets as a row.

This is my current search

|dbinspect index=main state =warm splunk_server=*idx02* | eval size=sizeOnDiskMB/1024| addcoltotals | fillnull value="Total" | table index,path,size

any and all help would be great

[somesoni2]

You need to use an appendpipe command, instead of addcoltotal which only does sum and only for numeric valued columns.

Give this a try

|dbinspect index=main state =warm splunk_server=*idx02* | eval size=sizeOnDiskMB/1024 | table index,path,size | appendpipe [| stats count(path) as path sum(size) as size | eval index="Total"]