Splunk Searches | A collection of useful Splunk SPL

Splunk Search for Hot, warm and cold buckets by index Copy


				|dbinspect index=* | search index!=_* | eval state=case(state=="warm" OR state=="hot","hot/warm",1=1, state) | chart dc(bucketId) over index by state

0 comments

[0]

Splunk Search for Buckets per indexer and index Copy


				| dbinspect index=* | search index!=_* | chart dc(bucketId) over splunk_server by index | rename splunk_server as Indexer

0 comments

[0]