Hi,
I'd like to be able to monitor the amount of data indexed daily (ie, "so far today") so I can surface this up to users of our NMS (who don't necessarily have access to our Splunk instances).
How can I get the amount of data indexed today (or more specifically, Today's License Usage) via a bash script?
Thanks,
Brett
Hi benziebgpcl,
you can run Splunk searches from the CLI or shell script like this as user splunk:
splunk@indexer:~ $ /opt/splunk/bin/splunk search "| rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | join type=outer stack_id [rest splunk_server=local /services/licenser/stacks | eval stack_id=title | eval stack_quota=quota | fields stack_id stack_quota] | stats sum(used_bytes) as used max(stack_quota) as total | eval usedGB=round(used/1024/1024/1024,3) | eval totalGB=round(total/1024/1024/1024,3) | eval gauge_base=0 | eval gauge_danger=totalGB*0.8 | eval gauge_top=totalGB+0.001 | gauge usedGB gauge_base gauge_danger totalGB gauge_top" -auth username:password
x y1 y2 y3 y4
----- -- -- ------ ------
0.393 0 8 10.000 10.001
splunk@indexer:~ $
build a wrapper script around it and your done.
Hope this helps ...
cheers, MuS
Hi benziebgpcl,
you can run Splunk searches from the CLI or shell script like this as user splunk:
splunk@indexer:~ $ /opt/splunk/bin/splunk search "| rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | join type=outer stack_id [rest splunk_server=local /services/licenser/stacks | eval stack_id=title | eval stack_quota=quota | fields stack_id stack_quota] | stats sum(used_bytes) as used max(stack_quota) as total | eval usedGB=round(used/1024/1024/1024,3) | eval totalGB=round(total/1024/1024/1024,3) | eval gauge_base=0 | eval gauge_danger=totalGB*0.8 | eval gauge_top=totalGB+0.001 | gauge usedGB gauge_base gauge_danger totalGB gauge_top" -auth username:password
x y1 y2 y3 y4
----- -- -- ------ ------
0.393 0 8 10.000 10.001
splunk@indexer:~ $
build a wrapper script around it and your done.
Hope this helps ...
cheers, MuS
and x
would be today's index volume and y3
the license size
Awesome, thanks MuS, exactly what I was hoping for.
Cheers,
Brett
Hi, pls tell me wats x,y1,y2,y3,y4
If you remove the last | gauge ...
search command you will see what each of the values represent. But here is the what they mean:
x = usedGB (License usage for today)
y1 = gauge_base (License base)
y2 = gauge_danger (License usage 80% of total license size)
y3 = totalGB (License total size)
y4 = gauge_top (License total size plus 1Kb)
cheers, MuS