topic Re: How to calculate percentage increase/decrease for indexes per day? in Splunk Search

How to calculate percentage increase/decrease for indexes per day?

jwalzerpitt — Mon, 17 Feb 2020 14:07:43 GMT

How would I calculate the percentage increase/decrease, for indexes on a per-day basis?

Thx

Re: How to calculate percentage increase/decrease for indexes per day?

richgalloway — Mon, 17 Feb 2020 14:15:48 GMT

Increase/decrease of what?

Re: How to calculate percentage increase/decrease for indexes per day?

jwalzerpitt — Mon, 17 Feb 2020 14:19:11 GMT

sorry about that - of the index size growth/shrinkage

Thx

Re: How to calculate percentage increase/decrease for indexes per day?

jwalzerpitt — Mon, 17 Feb 2020 14:24:30 GMT

Rich,

I've tried using timewrap, but I don't think I'm using it crrectly?

index=_internal source=*license_usage.log type="Usage" earliest=-1w@d 
| eval Date=strftime(_time, "%Y/%m/%d") 
| eventstats sum(b) as volume by idx, Date 
| eval GB=round(volume/1024/1024/1024,5)
| timechart first(GB) AS volume by idx
| timewrap 1w

Re: How to calculate percentage increase/decrease for indexes per day?

nickhills — Mon, 17 Feb 2020 14:57:17 GMT

Have you looked at the licensing reports? These will indicate the daily licence usage (volume indexed) for each index (or sourcetype).

Re: How to calculate percentage increase/decrease for indexes per day?

jwalzerpitt — Mon, 17 Feb 2020 15:11:28 GMT

I have, but there are no built-in searches/reports for % increase/decrease on a daily/monthly/etc basis

Re: How to calculate percentage increase/decrease for indexes per day?

nickhills — Mon, 17 Feb 2020 15:28:49 GMT

Try this as a starting point:

(index=_internal source=*license_usage.log* type="Usage") 
| eval idx=if(((len(idx) == 0) OR isnull(idx)),"(UNKNOWN)",idx)
| search idx=YOURINDEXNAME
|  bin span=1d _time 
| stats sum(b) as bytes by _time,idx
| delta bytes as change
| eval perc=round((change/bytes)*100,2)

Re: How to calculate percentage increase/decrease for indexes per day?

codebuilder — Mon, 17 Feb 2020 20:01:48 GMT

If you are using indexer discovery, this becomes very easy to solve.
On the cluster master UI, go to Settings > Monitoring Console (black bar) > Indexing (grey bar) > Index Detail: Deployment.

That interface will provide all the information you are seeking, and then some.

Re: How to calculate percentage increase/decrease for indexes per day?

codebuilder — Thu, 05 Mar 2020 08:08:32 GMT

If this suggestion resolved your issue, please consider accepting the answer, as it benefits others.