topic Re: Volume end of each day in Splunk Search

Volume end of each day

EH — Wed, 14 Oct 2020 14:38:51 GMT

Hi community, using Splunk for a ~month now and need some help,

If done correctly, I have the realtime volume/depot. Now I need the volume/depot at the end of each day last month. I'm stuck here, hope anyone can help me out.

index=BLA
| eventstats latest(status) as END_status by order_id
| search END_status IN
(
"Product Arrived at Final Depot"
"Processing Order at Depot"
"Ready for Transit to Final Depot"
"Processing Order for Client Delivery"
"Product Ready for Client Delivery"
"Ready for Transit to Nearest Depot"
)
| where status=END_status
| lookup products.csv product_id OUTPUT length, width, depth
| eval "volume"=round(length*width*depth/1000000,2)
| stats sum(volume) as "volume in m3" by depot_id

Re: Volume end of each day

ITWhisperer — Wed, 14 Oct 2020 15:32:34 GMT

Change this

| stats sum(volume) as "volume in m3" by depot_id

| bin span=1d _tme | stats sum(volume) as "volume in m3" by depot_id, _time

Re: Volume end of each day

EH — Wed, 14 Oct 2020 15:46:54 GMT

With this tho, I would still search on just that day. I need to take the last month in account as well.

Re: Volume end of each day

ITWhisperer — Wed, 14 Oct 2020 16:09:08 GMT

Set the query time to cover the last month, or whatever time period you want the daily volumes from