Splunk Search

index growth in last 7 days

surekhasplunk
Communicator

Hi,

Using below query now i am showing the trend of growth of one particular index for last 7 days.
index=_introspection (host=indexername) sourcetype=splunk_disk_objects component=Indexes
| rename data.* AS * | search name=assets | eval totalindexsize=total_size+datamodel_summary_size
| eval totalindexsize_GB=(totalindexsize/1024)
| fillnull value=0 totalindexsize_GB
| bin span=1d _time
| stats avg(totalindexsize_GB) AS Total_Index_Size(GB) by host,name,_time
| convert timeformat="%d-%m-%Y" ctime(_time) AS date
| rename name as IndexName
| table date, host, IndexName, Total_Index_Size(GB) | sort - Total_Index_Size(GB)

But my management wants to see growth of top 5 indexes which grew drastically.
how to achieve that. That too using the line graph

Thanks

Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @surekhasplunk,
did you explored the dashboards in Monitoring Console?
Anyway, try something like this:

index=_introspection sourcetype=splunk_disk_objects component=Indexes [ search 
     index=_introspection sourcetype=splunk_disk_objects component=Indexes 
     | stats avg(data.total_size) AS data.total_size BY data.name
     | sort - data.total_size
     | head 5
     | fields data.name ] 
| timechart span=1d avg(data.total_size) AS Total_Index_Size(GB) by data.name

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @surekhasplunk,
did you explored the dashboards in Monitoring Console?
Anyway, try something like this:

index=_introspection sourcetype=splunk_disk_objects component=Indexes [ search 
     index=_introspection sourcetype=splunk_disk_objects component=Indexes 
     | stats avg(data.total_size) AS data.total_size BY data.name
     | sort - data.total_size
     | head 5
     | fields data.name ] 
| timechart span=1d avg(data.total_size) AS Total_Index_Size(GB) by data.name

Ciao.
Giuseppe

0 Karma

surekhasplunk
Communicator

Thanks for this @gcusello,

But is there any way where i can show in the same query the difference of data between each day and sort via difference so that then its very clear that which particular index grew abnormally.
Hope am clear in what i am trying to say.

Thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...