topic Re: sourcetypes size trend in Getting Data In

sourcetypes size trend

SplunkySplunk — Sun, 03 Dec 2023 07:59:06 GMT

Hello

What is the best way to calculate sourcetypes size trend by time index and level ?

i tried this two options but couldn't find a way to see the trend :

index=_internal source=*license_usage.log* type=Usage idx=*| eval GB=b/1024/1024/1024 | stats sum(GB) by st idx

index=* | eval raw_len=len(_raw)/1024/1024/1024 | stats sum(raw_len) as totalsize count as NumberOfEvent by index sourcetype | sort -NumberOfEvent | fields - NumberOfEvent

Re: sourcetypes size trend

renjith_nair — Sun, 03 Dec 2023 13:59:25 GMT

Try including the _time as well in your search

Either using timechart or by _time bucket

index=_internal source=*license_usage.log* type=Usage idx=*| eval GB=b/1024/1024/1024 |timchart span=1d sum(gb) by st

index=_internal source=*license_usage.log* type=Usage idx=*| eval GB=b/1024/1024/1024 |bin _time span=1d | stats sum(GB) by _time,st

Re: sourcetypes size trend

sarit_s — Mon, 04 Dec 2023 09:29:23 GMT

Hello

It looks good but once im clicking on one of the graphs its shows no results:

also, i want to visualize by Level as well