Splunk Search

How do I combine storage statistics of indexes with the index, sourcetype, and host?

alanzchan
Path Finder

I can use a rest search from the services/data/indexesendpoint to calculate storage statistics, like the index size in GB, of each index. I would like to combine these storage statistics to a table that has the index, sourcetype, and host. Currently, I'm using this tstats search:

| tstats count where index=* by index sourcetype, host | stats list(host) as Hosts by index sourcetype| rename index as "Index", sourcetype as "Sourcetype(s)"

I don't believe that |rest and |tstats can be used together. Is there a way I can do this only using |tstats? Possibly by using license usage?

Any help is appreciated.

Tags (1)
0 Karma
1 Solution

adonio
Ultra Champion

why cant they used together?
| rest ... | stats ... keep index field ....
| append [ | tstats ....

or you can use | join for example
i think you might like the | dbisnpect command too, as you can calculate growth over time

something like that:

 | tstats values(sourcetype) as v_st values(host) as hosts where index=* by index
    | append [| rest /services/data/indexes | ... your statistics here ... by title
    | rename title as index]

hope it helps

View solution in original post

adonio
Ultra Champion

why cant they used together?
| rest ... | stats ... keep index field ....
| append [ | tstats ....

or you can use | join for example
i think you might like the | dbisnpect command too, as you can calculate growth over time

something like that:

 | tstats values(sourcetype) as v_st values(host) as hosts where index=* by index
    | append [| rest /services/data/indexes | ... your statistics here ... by title
    | rename title as index]

hope it helps

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!