How To find The Current Size And Total Event Count Of Any Index In Splunk
Hi guys !!
Have you ever thought of finding the current size and total event count of any index ??
Today we have come with a new and interesting topic of Splunk that is how to find the current size and total event count of any index in Splunk.
Run the below command in search bar.
| rest /servicesNS/-/search/data/indexes | table title,currentDBSizeMB,totalEventCount
Result :
See the above result, in title, currentDBSizeMB, totalEventCount fields we are getting the index names, current memory space used by the index and total count of events by the particular index respectively.
Hope this has helped you in achieving the below requirement without fail !!
How To find The Current Size And Total Event Count Of Any Index In Splunk
Happy Splunking !!
What’s your Reaction?
+1
+1
1
+1
2
+1
+1
+1
1
+1
I really appreciate for this, it is helpful for me in my current project
Thanks Mahesh !! You can always get such kind of reply for your any asked queries. Happy Splunking !!
Hi,
I have a doubt. When I run the above query in search. The results are showing 2 entries of each index with different DBsize value. Is it because of replication?
Does this gives the total event count for the index based on hot bucket or based on the total events that has been indexed since beginning till now for a particular index?
How can I filter particular index from this command?