| dbinspect index=*
| foreach * [eval dbinspect_<<FIELD>> = '<<FIELD>>']
| table dbinspect_*
| append [
| rest splunk_server_group=dmc_group_cluster_master "/services/cluster/master/buckets"
| foreach * [eval rest_api_<<FIELD>> = '<<FIELD>>']
| table rest_api_*
]
| eval bucketId=if(isNull(rest_api_title),dbinspect_bucketId,rest_api_title)
| stats values(*) as * by bucketId
| foreach rest_api_peers.*.* [eval rest_api_<<MATCHSEG2>>=""]
| foreach rest_api_peers.*.* [eval rest_api_<<MATCHSEG2>>=if("<<MATCHSEG1>>"=dbinspect_bucketId,'<<FIELD>>','<<MATCHSEG2>>')]
| fields - rest_api_peers.*
purpose:
requirements:
Needs to be executed on a search head that can query the cluster master REST API
comments:
The dbinspect API doesn't return consistent information about the size of buckets.