topic Re: Using Splunk Enterprise Search and Reporting in Dashboards & Visualizations

Using Splunk Enterprise Search and Reporting

maryamchar — Mon, 29 Oct 2018 15:27:15 GMT

hello,

I would like to show my daily usage of Splunk Volume, but also have a second graph represent how much it will be needed for 6 months volume with total.

Re: Using Splunk Enterprise Search and Reporting

iamarkaprabha — Tue, 30 Oct 2018 07:54:59 GMT

Hi ,

can you use this

 **index=_internal source=*metrics.log group="per_host_thruput" | eval GB=kb/1048576 | timechart sum(GB) as "total" by series span=1mon limit=0 | appendpipe [stats avg(*) as *]**

and set the time frame on your search for last six months

Re: Using Splunk Enterprise Search and Reporting

maryamchar — Tue, 30 Oct 2018 14:32:37 GMT

My question is i want to show how much storage i need for the next 6 months and i know amount already in GB which is 10,115 GB. Now i want to make a graph and show how much i use daily and show that i haven't reached that amount for 6 months yet, How would i do that ??? And represent that in visualization

Re: Using Splunk Enterprise Search and Reporting

iamarkaprabha — Tue, 30 Oct 2018 15:39:59 GMT

use this

  **index=_internal source=*metrics.log group="per_host_thruput" | eval GB=kb/1048576 | timechart sum(GB) as "total" by series span=1d limit=0 | appendpipe [stats avg(*) as *]**

Re: Using Splunk Enterprise Search and Reporting

maryamchar — Tue, 30 Oct 2018 18:56:52 GMT

That's what i have originally and i asked the question because i'm trying to find volume for 6 months

Re: Using Splunk Enterprise Search and Reporting

iamarkaprabha — Tue, 30 Oct 2018 19:03:39 GMT

You can use earliest and latest command to isolate the data of 6 month's

Re: Using Splunk Enterprise Search and Reporting

maryamchar — Tue, 30 Oct 2018 19:10:47 GMT

I want to write a query to show how much volume usage will i need for next 6 months. I already know the exact amount that need for 6 months which is 10,115GB. But i would like to show my daily usage and show that i haven't reached that 6 months amount yet, For example show that i used 50.00/10,115 GB

Re: Using Splunk Enterprise Search and Reporting

iamarkaprabha — Tue, 30 Oct 2018 19:24:20 GMT

Oh sorry . For next 6 month's , you have to use machine learning. There is a app called ML toolkit. By which you are write various regression techniques and show future data. Or there is a command called predict , you can use that also