REST Splunk job

[bharat]

Hi Splunkers,

I'm trying to get diskusage for searches running by user.

| rest /services/search/jobs
| rex field=eventSearch "index\s*=(?<index>[^,\s)]+)"
| search index=$ind$
| eval size_MB = diskUsage/1024/1024
| stats sum(size_MB) as size_MB by author
| rename author as user

Is there a way to get diskusage for historical log's like for a month or more. ?

[richgalloway]

Splunk REST commands return information about the current state of the service.  They are not historical.

Disk space used by search jobs is ephemeral.  Once the job expires (usually in 10 minutes), the disk space is released so a monthly total of disk usage is pretty meaningless.

What problem are you trying to solve?

[bharat]

Hi @richgalloway thanks for your response. 

So my requirement is to show disk usage of every user for their searches.  I tried with audit index but there I can see search name and it's count. 

I want to show the historical data of disk usage for each user. 

[richgalloway]

IIRC, the _introspection index has disk space usage data for searches.  I still question the utility of that information, however, since the usage is not cumulative.