How do I determine my indexing volume by host, source, or sourcetype?

Question

I need to know the breakdown of my license consumption on a per host, per source, and per sourcetype basis. What is the search to do this?

Accepted Answer

6

per host:

index="_internal" source="*metrics.log" group="per_host_thruput" | chart sum(kb) by series | sort - sum(kb)

per source:

index="_internal" source="*metrics.log" group="per_source_thruput" | chart sum(kb) by series | sort - sum(kb)

per sourcetype:

index="_internal" source="*metrics.log" group="per_sourcetype_thruput" | chart sum(kb) by series | sort - sum(kb)

link

answered 17 Jan '10, 11:39

ziegfried ♦
7.1k●1●3●15
accept rate: 52%

While the above search will work for most cases, only the top 10 values over 30 second periods are indexed by default. For this reason, you may not see low volume hosts populating the search results. You can increase the number of data points for the metrics.log file by editing the samples taken within limits.conf. See the following link and look for "metrics":

http://www.splunk.com/base/Documentation/latest/Admin/Limitsconf

(16 Apr '10, 17:45) Simeon ♦

Also see the following:

http://www.splunk.com/wiki/Community:TroubleshootingIndexedDataVolume

(16 Apr '10, 19:35) Simeon ♦

Answer 2

In the search app that Splunk ships with, under 'Status', there is a view called 'Indexing volume'. Go there and you'll see that it offers precisely this -- you can see your indexing volume broken down over time by source, by sourcetype, by host or by index.

Some raw searches themselves are posted in another answer but you'll probably find the custom view the most useful.

How do I determine my indexing volume by host, source, or sourcetype?

Follow this question

Splunk Resources

Related questions