Hi,
what would be the best way to find indexes with events and display its size, total events , earliest and latest events per index
on index cluster?
index size total_events earliest event latest event
alfa1 12Gb 1,000,000 2/2/2017 10:09 2/21/2019 9:01PM
alfa2 1Gb 90,000 1/1/2015 09:34 2/21/2109 9:02PM
Thank you in advance!
Use dbinspect (and a stats command after dbinspect) to get those information.
https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Dbinspect
Use dbinspect (and a stats command after dbinspect) to get those information.
https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Dbinspect
inputs.conf
with specified index & sourcetype and link it to shell script for each appsindex=existing_index_0 OR index=existing_index_n
|stats latest(index_size) as Size, count as total_events, earliest(_time) as FirstAppearance, latest(_time) as LastAppearance
| fieldformat FirstAppearance=strftime(FirstAppearance,"%x %X")
| fieldformat LastAppearance=strftime(LastAppearance,"%x %X")
Hi mlevsh,
Don't re-invent the wheel, take a look at the Monitoring Console inside Splunk Settings >> Monitoring Console
it contains dashboards that will show exactly what you want. Read more about the monitoring console here https://docs.splunk.com/Documentation/Splunk/latest/DMC/IndexingIndexesandvolumes
Hope this helps ...
cheers, MuS
@MuS , unfortunately it won't help. dashboard needs to be a little different in order to see info about indexes with events only and no events