I want to find daily Indexed size and over all Indexed size

[rakesh44]

Hi Friends,

I have one Index name myindex , with sourcetype application, need to find out daily and monthly Indexed size for specific Index.

| dbinspect index=myindex | eval GB=sizeOnDiskMB/1024| stats sum(GB)

Getting 15.46 GB is this correct for over all Index size, if yes then need to daily indexed size for myindex.Thanks

[chrisyounger · Accepted solution]

Oh also, if you use the timepicker with your current query it will work for what you want. Alternatively use this query:

| dbinspect index=_internal earliest=-1d@d latest=-0d@d | eval GB=sizeOnDiskMB/1024| stats sum(GB)

[rakesh44]

One help if am having 2 different sourcetype, and like to know which sourcetype took how much indexed size , do we have any such provision.Thanks

[chrisyounger]

Its not possible to determine the size on disk between two sourcetypes in the same index. This is because their terms/keywords will be shared.

If you wish to know the uncompressed size of the data you could do this:

index=myindex | eval len=len(_raw)| stats sum(len) by sourcetype

[chrisyounger]

Hi @rakesh44
There is a dashboard in the monitoring console that can easily tell you this information:

Settings >Monitoring Console >Indexing > License Usage

All the best

[rakesh44]

Thanks for quick reply, I dont have monitoring console.Thanks