I need to calculate the size of a clustered index, and I used this API for it: /services/cluster/manager/indexes (https://docs.splunk.com/Documentation/Splunk/9.0.2/RESTREF/RESTcluster#:~:text=content%3E%0A%20%20%3C/entry%3E%0A%3C/feed%3E-,cluster/manager/indexes,-https%3A//%3Chost%3E%3A%3CmPort)
But the index_size returned in the response is different (much less) from the total I get, if I use the dbinspect command on a particular index, and add size for the db_<buckets>. i.e. originating buckets.
Is the index_size supposed to denote something else? If so, it is not clearly mentioned in the API documentation.
... View more