Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- | rest splunk_server_group=dmc_group_cluster_master splunk_server_group="dmc_indexerclustergroup_BoR_Splunk" /services/cluster/master/indexes
- | fields title, is_searchable, replicated_copies_tracker*, searchable_copies_tracker*, num_buckets, index_size
- | rename replicated_copies_tracker.*.* as rp**, searchable_copies_tracker.*.* as sb**
- | eval replicated_data_copies = ""
- | foreach rp*actual_copies_per_slot [eval replicated_data_copies = replicated_data_copies." ".rp<<MATCHSTR>>actual_copies_per_slot."/".rp<<MATCHSTR>>expected_total_per_slot]
- | makemv replicated_data_copies
- | eval searchable_data_copies = ""
- | foreach sb*actual_copies_per_slot [eval searchable_data_copies = searchable_data_copies." ".sb<<MATCHSTR>>actual_copies_per_slot."/".sb<<MATCHSTR>>expected_total_per_slot]
- | makemv searchable_data_copies
- | eval is_searchable = if((is_searchable == 1) or (is_searchable == "1"), "Yes", "No")
- | eval index_size = round(index_size / 1024 / 1024 / 1024, 2)." GB"
- | search title="***"
- | eval replication_missing_buckets=rp1expected_total_per_slot-rp1actual_copies_per_slot
- | eval search_missing_buckets=sb1expected_total_per_slot-sb1actual_copies_per_slot
- | stats sum(search_missing_buckets) as total_missing_buckets
Add Comment
Please, Sign In to add comment