I've seen some other posts reference this, but I can't seem to get any of the solutions to work.
Here is the search:
| dbinspect index=foo state=hot
| stats sum(sizeOnDiskMB) as HotSize
| appendcols [ | dbinspect index=foo state=warm | stats sum(sizeOnDiskMB) as WarmSize]
| eval HotWarm = HotSize + WarmSize
| eval HotWarmTotal = HotWarm / 1024
| gauge HotWarmTotal 0 1.5 3 4.5 6 7.5
I am monitoring the size of our Hot/Warm buckets since we have them on a separate partition than cold. dbinspect doesn't allow to select hot AND warm buckets, so I use the above. When there is data in both hot and warm, this works fine.
However, for indexes with NO hot buckets, the entire search comes back empty, even though there are warm buckets with data.
How do I make sure the search comes back with warm bucket data even if there is no results for hot data?
Thanks!
... View more