dbinspect has to be run on the indexer. It can't be run from the search head. How do I get the result from my search head?
Schedule the following search to run on your indexer:
| dbinspect index=index_name
| rex field=path "^/path_to_index/(?P<index>\w+_\w+[^/]+)"
| fields state,id,rawSize,sizeOnDiskMB,index
| stats sum(rawSize) AS rawTotal, sum(sizeOnDiskMB) AS diskTotalinMB by index
| eval rawTotalinMB=(rawTotal / 1024 / 1024) | fields - rawTotal
| eval compression_factor=tostring(round((rawTotalinMB-diskTotalinMB) / rawTotalinMB , 2))
| table index,rawTotalinMB, diskTotalinMB, compression_factor
| summaryindex spool=t addtime=t index=summary
The summaryindex command writes the result to your summary index where you can fetch it from your SH.
I haven't figured out how to get a single search to do this for all my indexes. For now I set up a search for each index.
Have you looked at Fire Brigade? The TA includes inputs for dbinspect. You get a lot of information about your indexing and buckets from the app, and I highly recommend it. If you don't want the whole app, you could always pull apart the inputs.
HTH,
Dave
Schedule the following search to run on your indexer:
| dbinspect index=index_name
| rex field=path "^/path_to_index/(?P<index>\w+_\w+[^/]+)"
| fields state,id,rawSize,sizeOnDiskMB,index
| stats sum(rawSize) AS rawTotal, sum(sizeOnDiskMB) AS diskTotalinMB by index
| eval rawTotalinMB=(rawTotal / 1024 / 1024) | fields - rawTotal
| eval compression_factor=tostring(round((rawTotalinMB-diskTotalinMB) / rawTotalinMB , 2))
| table index,rawTotalinMB, diskTotalinMB, compression_factor
| summaryindex spool=t addtime=t index=summary
The summaryindex command writes the result to your summary index where you can fetch it from your SH.
I haven't figured out how to get a single search to do this for all my indexes. For now I set up a search for each index.