Getting Data In

disk usage for indexer

a212830
Champion

Hi,

Is there a way to track disk usage per day for indexes?

Tags (2)
0 Karma

barakreeves
Splunk Employee
Splunk Employee

On Windows, Mark Russinovich who brought us sysinternals, has a 'du' utility. This needs to be downloaded...or: run the "diskuse" command
On UNIX, run:
du -h -s

Run both as a scripted output.

You can have this command set to run every few hours or minutes and of course, Splunk the data. Once the data is in, you can create alerts.

0 Karma

a212830
Champion

setup for both internal and non-internal indexes.

0 Karma

barakreeves
Splunk Employee
Splunk Employee

How about going to Manager » Access controls » Roles » admin Indexes at the bottom and make sure Internal indexes are available; I have run into this before so it is the first thing I typically check. Let me know.

0 Karma

a212830
Champion

Returns nothing.

0 Karma

barakreeves
Splunk Employee
Splunk Employee

Try running this query: index=_internal type="Usage"
This query Splunks data from the license_usage.log file; one of the fields returned is "Pool" among other fields

0 Karma

a212830
Champion

Thought so. Thanks. So, now that I know that, how can I get license usage for the past week for a specific license pool?

0 Karma

Ayn
Legend

No, because indexes are compressed whereas license usage concerns the uncompressed amount of data.

0 Karma

a212830
Champion

So, a question on this - does license usage translate to disk storage use?

0 Karma

treinke
Builder

Are you looking to say these files were modified, added, deleted? Or are you looking to say the hard drive has this much free space and alert me when it is at this level? What is the OS that you want all this on?

There are no answer without questions
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...