topic Re: Eval Usage data to percentage as 1d span base, and table today, 1month ago, 3months ago, 6months ago in Splunk Search

Eval Usage data to percentage as 1d span base, and table today, 1month ago, 3months ago, 6months ago

splunkkid — Fri, 12 Mar 2021 01:53:31 GMT

Hello,

I'm trying to make time based table to check trend right away.

The data is currently accumulated on daily basis, which contains storage total GB, used GB per storage.

Now, I successfully made timechart that I can check trend of usage(used/ total * 100) data.

I made timechart viz with below command.

my base search | eval usage = round('storage.used' / 'storage.total' * 100, 2) | timechart span=1d limit=0 values(usage) by name

I want to make table that could show me usage data of today, 1month ago, 3months ago, 6months ago by storage. Like below. (Usage data must be calculated by used / total * 100 of the specific date.)

storage used total usage(today) usage(1mon) usage(3mon) usage(6mon)

A 30 100 30 27 25 23

...

Is there any way to make table such way?? Thank you.

Re: Eval Usage data to percentage as 1d span base, and table today, 1month ago, 3months ago, 6months ago

ITWhisperer — Fri, 12 Mar 2021 09:32:43 GMT

Assuming your events are already daily, and it is not clear what your fields are actually called since you use a mixture of names, try something like this

my base search | eval usage = round('storage.used' / 'storage.total' * 100, 2) | bin _time span=1d | where _time IN (relative_time(now(),"@d"), relative_time(now(),"-1mon@d"), relative_time(now(),"-3mon@d"), relative_time(now(),"-6mon@d")) | eval _time=case(_time=relative_time(now(),"@d"),"Today", _time=relative_time(now(),"-1mon@d"), "1mon", _time=relative_time(now(),"-3mon@d"), "3mon", _time=relative_time(now(),"-6mon@d"), "6mon") | chart limit=0 values(usage) as usage values('storage.used') as used values('storage.total') as total by name _time | transpose 0 | where match(column,"(name|usage:|used: Today|total: Today)") | rex field=column mode=sed "s/used:.*/used/g s/total:.*/total/g" | transpose 0 header_field=column | fields - column

Re: Eval Usage data to percentage as 1d span base, and table today, 1month ago, 3months ago, 6months ago

splunkkid — Sat, 13 Mar 2021 01:43:41 GMT

Thank you for your help!

Since I'm in busy for other schedule, I will check this soon and come back to whether accept as solution