Splunk indexers store data on disk in indexes, and the "total memory allocated" could refer to the total disk space available on the partition where Splunk stores its data (typically under $SPLUNK_HOME/var/lib/splunk). The "memory it is using" would then be the disk space consumed by the indexes, and the "remaining disk space left" would be the free space on that partition.
| rest /services/server/status/partitions-space splunk_server=*
| eval totalGB = round(capacity/1024/1024, 2)
| eval freeGB = round(free/1024/1024, 2)
| eval usedGB = round((capacity - free)/1024/1024, 2)
| table splunk_server, totalGB, usedGB, freeGB
To get the total memory allocated on an indexer and its current usage (which is different from disk space), you can use the following Splunk commands:
For memory information:
| rest /services/server/status/resource-usage/hostwide splunk_server=*
This will show you key metrics including:
- Total physical memory on the system
- Memory currently in use
- Available memory
If you're specifically interested in Splunk's memory usage:
For disk space information (which seems to be what you're actually asking about):
For specific index volume usage:
Note that memory usage and disk space are different resources. Memory refers to RAM available for processing, while disk space refers to storage capacity for data. Your question mentions memory but ends with disk space, so I've provided commands for both.
