Search to find indexes with events and display index size, total events , earliest and latest events per index

[mlevsh]

Hi,

what would be the best way to find indexes with events and display its size, total events , earliest and latest events per index
on index cluster?

index      size      total_events     earliest event       latest event
alfa1        12Gb     1,000,000       2/2/2017 10:09    2/21/2019 9:01PM
alfa2       1Gb        90,000         1/1/2015  09:34   2/21/2109 9:02PM

Thank you in advance!

[somesoni2 · Accepted solution]

Use dbinspect (and a stats command after dbinspect) to get those information.

https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Dbinspect

[andhika_pratama]

1. make a shell script to monitor directory size for each apps
2. create monitor in inputs.conf with specified index & sourcetype and link it to shell script for each apps
3. Make a field from selected pattern, name it index_size
4. use querry: index=existing_index_0 OR index=existing_index_n |stats latest(index_size) as Size, count as total_events, earliest(_time) as FirstAppearance, latest(_time) as LastAppearance | fieldformat FirstAppearance=strftime(FirstAppearance,"%x %X") | fieldformat LastAppearance=strftime(LastAppearance,"%x %X")

[MuS]

Hi mlevsh,

Don't re-invent the wheel, take a look at the Monitoring Console inside Splunk Settings >> Monitoring Console it contains dashboards that will show exactly what you want. Read more about the monitoring console here https://docs.splunk.com/Documentation/Splunk/latest/DMC/IndexingIndexesandvolumes

Hope this helps ...

cheers, MuS

[mlevsh]

@MuS , unfortunately it won't help. dashboard needs to be a little different in order to see info about indexes with events only and no events