How To find The Current Size And Total Event Count Of Any Index In Splunk

How To find The Current Size And Total Event Count Of Any Index In Splunk

Hi guys !!

Have you ever thought of finding the current size and total event count of any index ??

Today we have come with a new and interesting topic of Splunk that is how to find the current size and total event count of any index in Splunk.

Run the below command in search bar.

| rest /servicesNS/-/search/data/indexes
| table title,currentDBSizeMB,totalEventCount

Result :

See the above result, in title, currentDBSizeMB, totalEventCount  fields we are getting the index names, current  memory space used by the index and total count of events by the particular index respectively.

Hope this has helped you in achieving the below requirement without fail !!
How To find The Current Size And Total Event Count Of Any Index In Splunk

Happy Splunking !!

Advertisements

4 comments

  1. Hi,

    I have a doubt. When I run the above query in search. The results are showing 2 entries of each index with different DBsize value. Is it because of replication?

  2. Does this gives the total event count for the index based on hot bucket or based on the total events that has been indexed since beginning till now for a particular index?

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.