Splunk Search

max index size value

EricPartington
Communicator

How do I search for and return the max index size as defined by the indexes.conf file?

I want to get the same value that you can see from the Manager > indexes page (Max size (MB) of entire index )

metadata or dbinspect?

Tags (2)
0 Karma
1 Solution

cgilbert_splunk
Splunk Employee
Splunk Employee

Okay, I'll give it a shot...I didn't see any way of doing this with either metadata or dbinspect...but here's what I did:

1) I splunked Splunk...basically, I started monitoring my /splunk/etc directory and ingesting all my splunk config files
2) I determined that the parameter I was looking for in the indexes.conf file is: maxTotalDataSizeMB
3) I defined a field extraction to extract the "header" of each section of a splunk conf file...my regex is: (?im)^(?P

[.+]$) ...this helps when I perform my search
4) The search I used after doing all this was:

source="/splunk/etc/system/local/indexes.conf" | table Header maxTotalDataSizeMB | rename Header to Index

Index maxTotalDataSizeMB

[_thefishbucket] 600000

(this is what the results looked like...well, it looked better in Splunk, but hopefully you get the picture)...by the way, this matched up exactly to what I saw in manager.

Not at all sure if this solves your problem the way you wanted it solved, but I had fun trying to figure it out!

View solution in original post

cgilbert_splunk
Splunk Employee
Splunk Employee

Okay, I'll give it a shot...I didn't see any way of doing this with either metadata or dbinspect...but here's what I did:

1) I splunked Splunk...basically, I started monitoring my /splunk/etc directory and ingesting all my splunk config files
2) I determined that the parameter I was looking for in the indexes.conf file is: maxTotalDataSizeMB
3) I defined a field extraction to extract the "header" of each section of a splunk conf file...my regex is: (?im)^(?P

[.+]$) ...this helps when I perform my search
4) The search I used after doing all this was:

source="/splunk/etc/system/local/indexes.conf" | table Header maxTotalDataSizeMB | rename Header to Index

Index maxTotalDataSizeMB

[_thefishbucket] 600000

(this is what the results looked like...well, it looked better in Splunk, but hopefully you get the picture)...by the way, this matched up exactly to what I saw in manager.

Not at all sure if this solves your problem the way you wanted it solved, but I had fun trying to figure it out!

EricPartington
Communicator

I'll give this a shot, although I have a distributed environment and am using deployment server so i'll be looking to injest each indexes.conf file from each app.
should be interesting to see if this works.

thanks for the suggestion.

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...