Splunk Search

Run dbinspect as a scheduled job and make the result available to your SH

the_wolverine
Champion

dbinspect has to be run on the indexer. It can't be run from the search head. How do I get the result from my search head?

Tags (2)
0 Karma
1 Solution

the_wolverine
Champion

Schedule the following search to run on your indexer:

   | dbinspect index=index_name 
    | rex field=path "^/path_to_index/(?P<index>\w+_\w+[^/]+)"
    | fields state,id,rawSize,sizeOnDiskMB,index
    | stats sum(rawSize) AS rawTotal, sum(sizeOnDiskMB) AS diskTotalinMB by index
    | eval rawTotalinMB=(rawTotal / 1024 / 1024) | fields - rawTotal
    | eval compression_factor=tostring(round((rawTotalinMB-diskTotalinMB) / rawTotalinMB , 2)) 
    | table index,rawTotalinMB, diskTotalinMB, compression_factor 
    | summaryindex spool=t addtime=t index=summary

The summaryindex command writes the result to your summary index where you can fetch it from your SH.

I haven't figured out how to get a single search to do this for all my indexes. For now I set up a search for each index.

View solution in original post

dshpritz
SplunkTrust
SplunkTrust

Have you looked at Fire Brigade? The TA includes inputs for dbinspect. You get a lot of information about your indexing and buckets from the app, and I highly recommend it. If you don't want the whole app, you could always pull apart the inputs.

HTH,

Dave

the_wolverine
Champion

Schedule the following search to run on your indexer:

   | dbinspect index=index_name 
    | rex field=path "^/path_to_index/(?P<index>\w+_\w+[^/]+)"
    | fields state,id,rawSize,sizeOnDiskMB,index
    | stats sum(rawSize) AS rawTotal, sum(sizeOnDiskMB) AS diskTotalinMB by index
    | eval rawTotalinMB=(rawTotal / 1024 / 1024) | fields - rawTotal
    | eval compression_factor=tostring(round((rawTotalinMB-diskTotalinMB) / rawTotalinMB , 2)) 
    | table index,rawTotalinMB, diskTotalinMB, compression_factor 
    | summaryindex spool=t addtime=t index=summary

The summaryindex command writes the result to your summary index where you can fetch it from your SH.

I haven't figured out how to get a single search to do this for all my indexes. For now I set up a search for each index.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...