splunk-queries
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| splunk-queries [2024/02/13 10:54] – [Ingestion by Index] baumi | splunk-queries [2024/10/15 05:26] (current) – baumi | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ===== Splunk Queries ===== | + | ====== Splunk Queries ====== |
| + | |||
| + | ===== Indexes & Events ===== | ||
| + | ==== List Indexes ==== | ||
| + | < | ||
| + | | eventcount summarize=false index=* | ||
| + | | dedup index | ||
| + | | fields index | ||
| + | </ | ||
| ==== Count Events per Index ==== | ==== Count Events per Index ==== | ||
| < | < | ||
| | tstats count WHERE index=* OR index=_* by index | | tstats count WHERE index=* OR index=_* by index | ||
| </ | </ | ||
| - | ==== List Indexes ==== | ||
| < | < | ||
| - | | eventcount summarize=false | + | | tstats count where index=< |
| + | | timechart count span=1h | ||
| + | | addtotals | ||
| </ | </ | ||
| ==== Events per Host / Index / Sourcetype ==== | ==== Events per Host / Index / Sourcetype ==== | ||
| - | |||
| < | < | ||
| - | | tstats count as EVENTS_PER_HOST where index=* by index, | + | | tstats count as EVENTS_PER_HOST where index=* by index, |
| + | | table * | ||
| + | | sort by index | ||
| </ | </ | ||
| Line 23: | Line 33: | ||
| < | < | ||
| index=_internal sourcetype=splunkd source=*license_usage.log type=Usage | index=_internal sourcetype=splunkd source=*license_usage.log type=Usage | ||
| - | | timechart span=1d sum(b) as usage by idx limit=0 | foreach * [ eval "<< | + | | timechart span=1d sum(b) as usage by idx limit=0 |
| + | | foreach * [ eval "<< | ||
| </ | </ | ||
| - | ==== Export Lookup file ==== | ||
| + | ==== Total Ingestion ==== | ||
| + | < | ||
| + | index=_internal sourcetype=splunkd source=*license_usage.log type=Usage | ||
| + | | timechart span=1d sum(b) as usage | ||
| + | | eval gb=round(usage/ | ||
| + | | table _time, gb | ||
| + | </ | ||
| + | |||
| + | ===== Lookups & Macros ===== | ||
| + | |||
| + | ==== Export Lookup file ==== | ||
| < | < | ||
| | inputlookup my_lookup.csv | | inputlookup my_lookup.csv | ||
| </ | </ | ||
| - | ==== List of Macros ==== | ||
| + | ==== List of Macros ==== | ||
| < | < | ||
| | rest / | | rest / | ||
splunk-queries.1707818057.txt.gz · Last modified: 2024/02/13 10:54 by baumi