All,
I can't get access to admin tools on this instance of Splunk, just want to confirm this LEN command is accurate within reason for determining gigs used?
example -
index=pcf | eval total=len(_raw) | eval mygigs=1024/1024/1024 | stats sum(mygigs)
i will assume you are looking for license usage
if that is the case, i would say it is accurate enough. if the text formatting is not plain english, it can be off.
however, you can use the |dbinspect
command as i think you dont have to be an admin
try this and adjust your timepicker:
| dbinspect
| search index=YOUR_INDEX
| stats sum(rawSize) as raw_size sum(sizeOnDiskMB) as commited_to_disk by index
| eval raw_gb = round(raw_size/1024/1024/1024, 2), committed_gb = round(commited_to_disk/1024, 2)
hope it helps