Splunk Search

How do I combine storage statistics of indexes with the index, sourcetype, and host?

alanzchan
Path Finder

I can use a rest search from the services/data/indexesendpoint to calculate storage statistics, like the index size in GB, of each index. I would like to combine these storage statistics to a table that has the index, sourcetype, and host. Currently, I'm using this tstats search:

| tstats count where index=* by index sourcetype, host | stats list(host) as Hosts by index sourcetype| rename index as "Index", sourcetype as "Sourcetype(s)"

I don't believe that |rest and |tstats can be used together. Is there a way I can do this only using |tstats? Possibly by using license usage?

Any help is appreciated.

Tags (1)
0 Karma
1 Solution

adonio
Ultra Champion

why cant they used together?
| rest ... | stats ... keep index field ....
| append [ | tstats ....

or you can use | join for example
i think you might like the | dbisnpect command too, as you can calculate growth over time

something like that:

 | tstats values(sourcetype) as v_st values(host) as hosts where index=* by index
    | append [| rest /services/data/indexes | ... your statistics here ... by title
    | rename title as index]

hope it helps

View solution in original post

adonio
Ultra Champion

why cant they used together?
| rest ... | stats ... keep index field ....
| append [ | tstats ....

or you can use | join for example
i think you might like the | dbisnpect command too, as you can calculate growth over time

something like that:

 | tstats values(sourcetype) as v_st values(host) as hosts where index=* by index
    | append [| rest /services/data/indexes | ... your statistics here ... by title
    | rename title as index]

hope it helps

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...