- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Is there a way to determine how much disk space my...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Is there a way to determine how much disk space a sourcetype is using?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So here's one option. You can see how much data you are indexing for a given time period per sourcetype. The general rule for Splunk disk storage is 1/2 X Indexing X Days. Example: 1/2 X 5 gb X 365 days = 912.5 GB of storage.
index=internal metrics kb series!=* "group=per_sourcetype_thruput" | stats sum(indexed_mb) by series
Another option might be using the dbinspect command:
| dbinspect index=my_index
If you can estimate the percentage of the index your sourcetype takes up, you can can an accurate estimate of the disk usage. Reference: http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Dbinspect
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So here's one option. You can see how much data you are indexing for a given time period per sourcetype. The general rule for Splunk disk storage is 1/2 X Indexing X Days. Example: 1/2 X 5 gb X 365 days = 912.5 GB of storage.
index=internal metrics kb series!=* "group=per_sourcetype_thruput" | stats sum(indexed_mb) by series
Another option might be using the dbinspect command:
| dbinspect index=my_index
If you can estimate the percentage of the index your sourcetype takes up, you can can an accurate estimate of the disk usage. Reference: http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Dbinspect
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
in 6.1 that didn't seem to work at all for me. i found success with the following:
index=_internal metrics kb group=per_sourcetype_thruput | eval sizeMB = round(kb/1024,2)| stats sum(sizeMB) by series | sort -sum(sizeMB) | rename sum(sizeMB) AS "Size on Disk (MB)"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would be careful to convert to MB and round after sum'ing, not before
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Utilized your method @awurster and it worked perfectly. Thanks
Detecting Remote Code Executions With the Splunk Threat Research Team
Observability | Use Synthetic Monitoring for Website Metadata Verification
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
