Need to lookup index volume by sourcetype for past year

[balbano]

Hey guys,

Got another one for ya:

I need to lookup sourcetypes for the past year.

I basically need to know how to run a search similar to the "Index Volume" report on the GUI.

Currently, if I run the Index Volume report for the past year it will take forever and my WebGUI session will die. I want to see if there is anyway to run this query and then export it to CSV somehow.

I have seen the other question posts and the index volume troubleshooting page but I'd like to tailor those queries to go back for the past year in relative time (-12m) and then export to CSV.

Any help you can provide would be great.

If you need any clarification on anything let me know.

Thanks.

Brian

[lguinn2 · Accepted solution]

Try this

index=_internal source=*metrics.log group=per_sourcetype_thruput | eval MB=round(kb/1024,3) | 
stats sum(MB) as IndexedMB by series | rename series as sourcetype | outputcsv IndexBySourcetype

I don't know how it will perform over a year's worth of data, though.

[balbano]

I decided to just schedule this search to run in the background and email me the results. That should work!!!

[balbano]

Thanks Iguinn, I will give it a shot, is there a way to run this in the background, perhaps on CLI (which I know nothing about?) My concern is that my web session may expire in the process of running this query. If you know anything that might be able to solve that issue, that would be great. Let me know. Thanks. -Brian