Last active
November 20, 2018 19:47
-
-
Save faststeak/cd7bb5c99fc19224e60fa6b97821a57d to your computer and use it in GitHub Desktop.
Splunk Search for seeing the status of replication
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| rest splunk_server_group=dmc_group_cluster_master /services/cluster/master/indexes | |
| fields title, is_searchable, replicated_copies_tracker*, searchable_copies_tracker*, num_buckets, index_size | |
| rename replicated_copies_tracker.*.* as rp**, searchable_copies_tracker.*.* as sb** | |
| eval replicated_data_copies = "" | |
| foreach rp*actual_copies_per_slot [eval replicated_data_copies = replicated_data_copies." ".rp<<MATCHSTR>>actual_copies_per_slot."/".rp<<MATCHSTR>>expected_total_per_slot] | |
| makemv replicated_data_copies | |
| eval searchable_data_copies = "" | |
| foreach sb*actual_copies_per_slot [eval searchable_data_copies = searchable_data_copies." ".sb<<MATCHSTR>>actual_copies_per_slot."/".sb<<MATCHSTR>>expected_total_per_slot] | |
| makemv searchable_data_copies | |
| eval is_searchable = if((is_searchable == 1) or (is_searchable == "1"), "Yes", "No") | |
| eval index_size = round(index_size / 1024 / 1024 / 1024, 2)." GB" | |
| search title="***" | |
| foreach rp*actual_copies_per_slot [eval replication_<<MATCHSTR>>_missing_buckets=rp<<MATCHSTR>>expected_total_per_slot-rp<<MATCHSTR>>actual_copies_per_slot] | |
| foreach sb*actual_copies_per_slot [eval search_<<MATCHSTR>>_missing_buckets=sb<<MATCHSTR>>expected_total_per_slot-sb<<MATCHSTR>>actual_copies_per_slot] | |
| stats sum(replication_*_missing_buckets) as total_replication_*_missing_buckets sum(search_*_missing_buckets) as search_replication_*_missing_buckets |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment