topic Re: Help to find daily indexed data size by each index in Getting Data In

Help to find daily indexed data size by each index

dhavamanis — Wed, 10 Jun 2015 19:10:56 GMT

Need your help,

Can you please tell us, how to find daily indexed data size by each index?

Re: Help to find daily indexed data size by each index

ppablo — Wed, 10 Jun 2015 19:30:43 GMT

Hi @dhavamanis

There are large number of the same, if not similar, question already posted on Answers. Do the search(es) in this post answer your question? There's an option per day and per month.
http://answers.splunk.com/answers/154773/how-to-create-a-report-that-shows-max-indexed-volume-per-day-by-month-per-index.html

Re: Help to find daily indexed data size by each index

dhavamanis — Wed, 10 Jun 2015 20:19:45 GMT

Thanks, i have just added wildcard search for source to get the results.

index=_internal source="*license_usage.log*" type=Usage  | eval yearmonthday=strftime(_time, "%Y%m%d") | eval yearmonth=strftime(_time, "%Y%m%d") | stats sum(eval(b/1024/1024/1024)) AS volume_b by idx yearmonthday yearmonth | chart sum(volume_b) over yearmonth by idx

Re: Help to find daily indexed data size by each index

ppablo — Wed, 10 Jun 2015 20:26:15 GMT

Great, I'm glad it helped you find your solution 🙂

Re: Help to find daily indexed data size by each index

indut — Thu, 20 Feb 2025 10:19:22 GMT

hi, Why do we have 2 fields yearmonthday and yearmonth in this query?

Re: Help to find daily indexed data size by each index

indut — Thu, 20 Feb 2025 22:50:00 GMT

hi any update on this from anyone ? Thank you!