Skip to content

Instantly share code, notes, and snippets.

@faststeak
Last active November 20, 2018 19:47
Show Gist options
  • Save faststeak/cd7bb5c99fc19224e60fa6b97821a57d to your computer and use it in GitHub Desktop.
Save faststeak/cd7bb5c99fc19224e60fa6b97821a57d to your computer and use it in GitHub Desktop.
Splunk Search for seeing the status of replication
| rest splunk_server_group=dmc_group_cluster_master /services/cluster/master/indexes
| fields title, is_searchable, replicated_copies_tracker*, searchable_copies_tracker*, num_buckets, index_size
| rename replicated_copies_tracker.*.* as rp**, searchable_copies_tracker.*.* as sb**
| eval replicated_data_copies = ""
| foreach rp*actual_copies_per_slot [eval replicated_data_copies = replicated_data_copies." ".rp<<MATCHSTR>>actual_copies_per_slot."/".rp<<MATCHSTR>>expected_total_per_slot]
| makemv replicated_data_copies
| eval searchable_data_copies = ""
| foreach sb*actual_copies_per_slot [eval searchable_data_copies = searchable_data_copies." ".sb<<MATCHSTR>>actual_copies_per_slot."/".sb<<MATCHSTR>>expected_total_per_slot]
| makemv searchable_data_copies
| eval is_searchable = if((is_searchable == 1) or (is_searchable == "1"), "Yes", "No")
| eval index_size = round(index_size / 1024 / 1024 / 1024, 2)." GB"
| search title="***"
| foreach rp*actual_copies_per_slot [eval replication_<<MATCHSTR>>_missing_buckets=rp<<MATCHSTR>>expected_total_per_slot-rp<<MATCHSTR>>actual_copies_per_slot]
| foreach sb*actual_copies_per_slot [eval search_<<MATCHSTR>>_missing_buckets=sb<<MATCHSTR>>expected_total_per_slot-sb<<MATCHSTR>>actual_copies_per_slot]
| stats sum(replication_*_missing_buckets) as total_replication_*_missing_buckets sum(search_*_missing_buckets) as search_replication_*_missing_buckets
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment