The Index Mines • Room 4

🖥️ SPL Lab: Investigating Index Health

Admins regularly check index health using the _internal index. You can search for indexing metrics, pipeline throughput, and queue usage.

The dbinspect command provides detailed information about index buckets — their sizes, time ranges, and lifecycle state.

dbinspect usage

| dbinspect index=main | stats sum(sizeOnDiskMB) as totalMB by state

Knowledge Check

Prove your understanding to clear the room (Rewards XP)

Write a search that counts errors in _internal by the component field, sorted by count descending.

Splunk Search Bar