Splunk Search

Run dbinspect as a scheduled job and make the result available to your SH

the_wolverine
Champion

dbinspect has to be run on the indexer. It can't be run from the search head. How do I get the result from my search head?

Tags (2)
0 Karma
1 Solution

the_wolverine
Champion

Schedule the following search to run on your indexer:

   | dbinspect index=index_name 
    | rex field=path "^/path_to_index/(?P<index>\w+_\w+[^/]+)"
    | fields state,id,rawSize,sizeOnDiskMB,index
    | stats sum(rawSize) AS rawTotal, sum(sizeOnDiskMB) AS diskTotalinMB by index
    | eval rawTotalinMB=(rawTotal / 1024 / 1024) | fields - rawTotal
    | eval compression_factor=tostring(round((rawTotalinMB-diskTotalinMB) / rawTotalinMB , 2)) 
    | table index,rawTotalinMB, diskTotalinMB, compression_factor 
    | summaryindex spool=t addtime=t index=summary

The summaryindex command writes the result to your summary index where you can fetch it from your SH.

I haven't figured out how to get a single search to do this for all my indexes. For now I set up a search for each index.

View solution in original post

dshpritz
SplunkTrust
SplunkTrust

Have you looked at Fire Brigade? The TA includes inputs for dbinspect. You get a lot of information about your indexing and buckets from the app, and I highly recommend it. If you don't want the whole app, you could always pull apart the inputs.

HTH,

Dave

the_wolverine
Champion

Schedule the following search to run on your indexer:

   | dbinspect index=index_name 
    | rex field=path "^/path_to_index/(?P<index>\w+_\w+[^/]+)"
    | fields state,id,rawSize,sizeOnDiskMB,index
    | stats sum(rawSize) AS rawTotal, sum(sizeOnDiskMB) AS diskTotalinMB by index
    | eval rawTotalinMB=(rawTotal / 1024 / 1024) | fields - rawTotal
    | eval compression_factor=tostring(round((rawTotalinMB-diskTotalinMB) / rawTotalinMB , 2)) 
    | table index,rawTotalinMB, diskTotalinMB, compression_factor 
    | summaryindex spool=t addtime=t index=summary

The summaryindex command writes the result to your summary index where you can fetch it from your SH.

I haven't figured out how to get a single search to do this for all my indexes. For now I set up a search for each index.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...