Back to Floor
The Index Mines • Room 4

🖥️ SPL Lab: Investigating Index Health

Admins regularly check index health using the _internal index. You can search for indexing metrics, pipeline throughput, and queue usage.

The dbinspect command provides detailed information about index buckets — their sizes, time ranges, and lifecycle state.

dbinspect usage
| dbinspect index=main | stats sum(sizeOnDiskMB) as totalMB by state

Knowledge Check

Prove your understanding to clear the room (Rewards XP)
Write a search that counts errors in _internal by the component field, sorted by count descending.
Splunk Search Bar
>