Hi,
Newbie splunk question. I have a Splunk server that is running out of disk space. Looking at all the indexes, I have a "system" app (name = "main") with the homepath of '$SPLUNK_DB/defaultdb/db ' that is occupying most of the space.
How can I find out what data is being stored in this index? That will help me decide if I need to reduce the max-size or add more space.
Thanks
Aspi
That's your default index, where events go when no other index was defined.
One way to characterize the type of data in it would be:
| tstats count WHERE index=main BY sourcetype
I'm sure there other methods of reporting to actually determine storage size per sourcetype/source/host/whatever, but this may give you a quick enough answer.