I tried this,
| dbinspect index=test | eval GB=sizeOnDiskMB/1024| addinfo span=-2d | stats sum(GB) as today
| append
[| dbinspect index=test | eval GB=sizeOnDiskMB/1024 | addinfo span=-1d | stats sum(GB) as yesterday ]
I am not getting accurate results from above. Can any one suggest a query with accurate results?
Thanks.
Use the license usage query (run this on your license server OR search head, if you forward license server logs to indexers searchable by search head). Use appropriate time range (e.g. earliest=-1d@d latest=now)
index=_internal sourcetype=splunkd component=LicenseUsage idx=test
| timechart span=1d sum(b) as usage
| eval usageGB=round(usage/1024/1024/1024,2)
@somesoni2 thanks, The query you mentioned gives license usage of index, I am looking to figure out how much data i am getting from all servers to that particular index(ex:test) and compare today's data to yesterday's data.
And can you please explain difference between
index=_internal sourcetype=splunkd component=LicenseUsage idx=test
| timechart span=1d sum(b) as usage
| eval usageGB=round(usage/1024/1024/1024,2)
And
| dbinspect index=test | eval GB=sizeOnDiskMB/1024 | stats sum(GB)
Thanks.