SPL
Use REST to gather Index Info
Description
Here is some SPL to get useful information via REST on indexes within your Splunk environment:
4 3
| REST /services/data/indexes | eval currentDBSizeMB=tostring(currentDBSizeMB, "commas") | eval totalEventCount=tostring(totalEventCount, "commas") | eval frozenTimePeriodInHours=(frozenTimePeriodInSecs/60/60) | table title splunk_server currentDBSizeMB frozenTimePeriodInHours maxTime minTime totalEventCount
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.