Indexed volume search shows results only for the past month

[thipsz]

Hello, Various search queries found here at Splunk Answers can provide index volume information. Several of them that I tried seem to never provide any results from time period prior to 1 month ago. Is there a way to find out why? Searching for data older than 1 month works fine.

Update: Looks like index volume information is limited to earliest event in _thefishbucket index. That's not the case.

[thipsz]

Hi Crhis, Thx for the info and link, it provides what I'm looking for. We're utilizing distributed search and the below query pulls information from peers as well. We've tried localop to limit query to local server, it doesn't work. Is there a way to limit license usage information to one splunk instance?

| file /opt/splunk/var/log/splunk/license_audit.log | localop | search LicenseManager-Audit todaysBytesIndexed | kv | eval totalGB=todaysBytesIndexed/1024/1024/1024 | timechart sum(totalGB)

[chris]

This wiki page is also useful:
http://www.splunk.com/wiki/Community:TroubleshootingIndexedDataVolume

[chris]

You can try this: index=_internal LicenseManager-Audit todaysBytesIndexed host=xyz | kv | eval totalGB=todaysBytesIndexed/1024/1024/1024 | timechart sum(totalGB) by host if you know which host you want to look at

[chris · Accepted solution]

Hi Thipsz

The queries in the search application are based on the _internal index which only keeps Data for a limited amount of time.

You can see what the period is set to by looking at the indexes.conf file in $SPLUNK_HOME/etc/system/default

[_internal]
homePath = $SPLUNK_DB/_internaldb/db
coldPath = $SPLUNK_DB/_internaldb/colddb
thawedPath = $SPLUNK_DB/_internaldb/thaweddb
maxDataSize = 100
frozenTimePeriodInSecs = 2419200

The relevant parameter is frozenTimePeriodInSecs

You can override the value by inserting the following in the local indexes.conf ($SPLUNK_HOME/etc/system/local/indexes.conf)

[_internal]
maxDataSize = <Possibly more than 100 MB>
frozenTimePeriodInSecs = <your desired period>

It is probably better to use summary indexing a suggested by the following answer: http://answers.splunk.com/questions/5299/year-to-date-splunk-license-bandwidth-usage

I hope this helps

Chris