Splunk Search

index growth in last 7 days

surekhasplunk
Communicator

Hi,

Using below query now i am showing the trend of growth of one particular index for last 7 days.
index=_introspection (host=indexername) sourcetype=splunk_disk_objects component=Indexes
| rename data.* AS * | search name=assets | eval totalindexsize=total_size+datamodel_summary_size
| eval totalindexsize_GB=(totalindexsize/1024)
| fillnull value=0 totalindexsize_GB
| bin span=1d _time
| stats avg(totalindexsize_GB) AS Total_Index_Size(GB) by host,name,_time
| convert timeformat="%d-%m-%Y" ctime(_time) AS date
| rename name as IndexName
| table date, host, IndexName, Total_Index_Size(GB) | sort - Total_Index_Size(GB)

But my management wants to see growth of top 5 indexes which grew drastically.
how to achieve that. That too using the line graph

Thanks

Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @surekhasplunk,
did you explored the dashboards in Monitoring Console?
Anyway, try something like this:

index=_introspection sourcetype=splunk_disk_objects component=Indexes [ search 
     index=_introspection sourcetype=splunk_disk_objects component=Indexes 
     | stats avg(data.total_size) AS data.total_size BY data.name
     | sort - data.total_size
     | head 5
     | fields data.name ] 
| timechart span=1d avg(data.total_size) AS Total_Index_Size(GB) by data.name

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @surekhasplunk,
did you explored the dashboards in Monitoring Console?
Anyway, try something like this:

index=_introspection sourcetype=splunk_disk_objects component=Indexes [ search 
     index=_introspection sourcetype=splunk_disk_objects component=Indexes 
     | stats avg(data.total_size) AS data.total_size BY data.name
     | sort - data.total_size
     | head 5
     | fields data.name ] 
| timechart span=1d avg(data.total_size) AS Total_Index_Size(GB) by data.name

Ciao.
Giuseppe

0 Karma

surekhasplunk
Communicator

Thanks for this @gcusello,

But is there any way where i can show in the same query the difference of data between each day and sort via difference so that then its very clear that which particular index grew abnormally.
Hope am clear in what i am trying to say.

Thanks

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...