Refine your search:

5
1

I would like to see the following for each index

  • limit (maximum size) Mb
  • current size Mb
  • avg. Mb indexed per day last 30 days

  • for hot, warm, cold:

    • # buckets
    • earliest, latest date (across all buckets in category)
    • current size Mb

Some of this information can be seen in current reports, but not all in one place. Other data, like the breakout by hot, warm, and cold categories, does not seem to appear anywhere in the Status selections.

Does this report, or anything like it, exist?

asked 23 Apr '10, 21:21

lguinn's gravatar image

lguinn ♦
3.0k216
accept rate: 25%

edited 27 Apr '10, 07:17

nick's gravatar image

nick ♦
14.2k1318


3 Answers:

Well indeed it would be awesome if we had a more detailed view, or if drilldown interaction from the status view took you to a richer detail view about a particular category/bucket/index etc..

But in the meantime, I can answer some of these at the search language level.

1) the question about seeing stats for the hot vs warm and cold buckets.
This search will do it. (I kinda like your convention of breaking it up by command so I'll follow it)

| dbinspect timeformat="%s" 
| rename state as category 
| stats min(earliestTime) as earliestTime max(latestTime) as latestTime sum(sizeOnDiskMB) as MB by category 
| convert timeformat="%m/%d/%Y" ctime(earliestTime) as earliestTime ctime(latestTime) as latestTime

You can use a different timeformat obviously, but that'll give you a table that looks like:

category    earliestTime     latestTime     MB
hot         04/21/2010       04/24/2010     2033.864350
warm        02/18/2010       04/22/2010     8033.864350
...

2) the sum in MB per index, for each day in the last 30 days:

if you want to eventually chart it in a FlashChart, use chart:

index=_internal source=*metrics.log group=per_index_thruput 
| eval MB=kb/1024 
| timechart span=1d sum(MB) by series 
| fields - VALUE_*

If on the other hand you want to end up with a table where each row is a unique combination of a day plus an index, you'd take away the timechart and use a bin command and a stats command instead.

3) as for the actual current size on disk of each index, i dont know of a way but its very possible that someone else does.
I do know that in the output of the dbinspect command, one could tease out the 'defaultdb' part of the 'path' field, and then do a chart/stats/timechart split by that field and that could sum up the sizeOnDiskMB field quite easily...

link

answered 23 Apr '10, 22:45

nick's gravatar image

nick ♦
14.2k1318
accept rate: 47%

edited 23 Apr '10, 22:57

This kind of report does not currently exist as far as I know.

You will likely need to use a combination of searches against the internal index and metadata to create a report which tells you all of this information.

link

answered 23 Apr '10, 21:48

Simeon's gravatar image

Simeon ♦
3.7k5627
accept rate: 26%

If you´ve build one, maybe you can share. I would like to have something like this as well, or at least get the idea how to do it.

link

answered 09 Jun '10, 13:49

tpaulsen's gravatar image

tpaulsen
92114
accept rate: 8%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×333
×299
×115

Asked: 23 Apr '10, 21:21

Seen: 1,735 times

Last updated: 09 Jun '10, 13:49

Copyright © 2005-2012 Splunk, Inc. All rights reserved.