Skip to content

Splunk Search Command Series: dbinspect


Written by: Kinney Group | Last Updated:

July 7, 2022

Originally Published:

October 16, 2020



The power of Splunk comes from the insights we pull from our data. And to emphasize… I mean searchable data. Now, Splunk isn’t perfect and neither is your data. Data can be corrupt, go missing, or frankly, live in the dark. Pull that data back into the light and ensure your data is intact by using dbinspect.

What is dbinspect? The Splunk search command, dbinspect, allows us to look at the information of buckets that make up a specified index.  If you’re using Splunk Enterprise, this search command shows you where your data lives so you can optimize your disk space.

How to Use dbinspect

Let’s break down the command:  

|dbinspect index=<index_nametimeformat=<time format> 

Check out what this looks like in Splunk:  

Figure 1 - dbinspect in Splunk
Figure 1 – dbinspect in Splunk


The above screenshot may look small as it doesn’t capture all of the fields, but, the fields we DO see provide us with a wealth of information. When you use the command, you’ll have access to view all of the fields we can’t see in the screenshot.

New call-to-action


Here’s what we can see with dbinspect: 

How many events are in a bucket 

The file path of the bucket 

Which index the bucket belongs too 


dbinspect also tells us: 

The state of the bucket (hot/warm/cold) 

When the bucket was created 

The size of the bucket in mb 

And tsidx states (full, fulling, etc) 


And that’s it. Use dbinspect to get insights into your data buckets. We’ve got plenty of searches to come this month, stay tuned!

Ask the Experts

Our Splunk Search Command Series is created by our Expertise on Demand (EOD) experts. Every day, our team of Splunk certified professionals works with customers through Splunk troubleshooting support, including Splunk search command best practice. If you’re interested in learning more about our EOD service or chat with our team of experts, fill out the form below!

New call-to-action
Helpful? Don't forget to share this post!
Share on linkedin
Share on reddit
Share on email
Share on twitter
Share on facebook

No comment yet, add your voice below!

Add a Comment

Your email address will not be published. Required fields are marked *