https://community.splunk.com/t5/Monitoring-Splunk/Query-to-compare-total-throughput-for-two-distinct-dates/m-p/670184#M9903 <P>Try something like this</P><LI-CODE lang="markup">index=_internal (host=`sim_indexer_url` OR host=`sim_si_url`) sourcetype=splunkd group=per_Index_thruput series!=_* (earliest=@d latest=now) OR (earliest=-60d@d latest=-59d@d) | timechart minspan=30s per_second(kb) as kb by series</LI-CODE> Wed, 29 Nov 2023 13:16:25 GMT ITWhisperer 2023-11-29T13:16:25Z https://community.splunk.com/t5/Monitoring-Splunk/Query-to-compare-total-throughput-for-two-distinct-dates/m-p/670173#M9902 <P>I would like to compare total throughput for two dates 60 days apart (say, current and -60d). The query in the CMC that generates the throughput is&nbsp;</P> <LI-CODE lang="markup">index=_internal (host=`sim_indexer_url` OR host=`sim_si_url`) sourcetype=splunkd group=per_Index_thruput series!=_* | timechart minspan=30s per_second(kb) as kb by series</LI-CODE> <P>I need the series information, but it could be binned into 1 whole day.</P> <P>&nbsp;</P> Wed, 29 Nov 2023 12:54:14 GMT https://community.splunk.com/t5/Monitoring-Splunk/Query-to-compare-total-throughput-for-two-distinct-dates/m-p/670173#M9902 chama4tem 2023-11-29T12:54:14Z https://community.splunk.com/t5/Monitoring-Splunk/Query-to-compare-total-throughput-for-two-distinct-dates/m-p/670184#M9903 <P>Try something like this</P><LI-CODE lang="markup">index=_internal (host=`sim_indexer_url` OR host=`sim_si_url`) sourcetype=splunkd group=per_Index_thruput series!=_* (earliest=@d latest=now) OR (earliest=-60d@d latest=-59d@d) | timechart minspan=30s per_second(kb) as kb by series</LI-CODE> Wed, 29 Nov 2023 13:16:25 GMT https://community.splunk.com/t5/Monitoring-Splunk/Query-to-compare-total-throughput-for-two-distinct-dates/m-p/670184#M9903 ITWhisperer 2023-11-29T13:16:25Z https://community.splunk.com/t5/Monitoring-Splunk/Query-to-compare-total-throughput-for-two-distinct-dates/m-p/670293#M9904 <P>Hi this doesn't work; I'm not getting anything for the earlier dates (and I have expanded the date range to two days before the -60 date and today).</P> Thu, 30 Nov 2023 10:57:53 GMT https://community.splunk.com/t5/Monitoring-Splunk/Query-to-compare-total-throughput-for-two-distinct-dates/m-p/670293#M9904 chama4tem 2023-11-30T10:57:53Z https://community.splunk.com/t5/Monitoring-Splunk/Query-to-compare-total-throughput-for-two-distinct-dates/m-p/670297#M9905 <P>What is the retention period on your index or the earliest event in your index?</P> Thu, 30 Nov 2023 11:13:34 GMT https://community.splunk.com/t5/Monitoring-Splunk/Query-to-compare-total-throughput-for-two-distinct-dates/m-p/670297#M9905 ITWhisperer 2023-11-30T11:13:34Z https://community.splunk.com/t5/Monitoring-Splunk/Query-to-compare-total-throughput-for-two-distinct-dates/m-p/670299#M9906 <P>90 days</P> Thu, 30 Nov 2023 11:19:20 GMT https://community.splunk.com/t5/Monitoring-Splunk/Query-to-compare-total-throughput-for-two-distinct-dates/m-p/670299#M9906 chama4tem 2023-11-30T11:19:20Z https://community.splunk.com/t5/Monitoring-Splunk/Query-to-compare-total-throughput-for-two-distinct-dates/m-p/670300#M9907 <P>So what is the time of your earliest event?</P> Thu, 30 Nov 2023 11:20:56 GMT https://community.splunk.com/t5/Monitoring-Splunk/Query-to-compare-total-throughput-for-two-distinct-dates/m-p/670300#M9907 ITWhisperer 2023-11-30T11:20:56Z