https://community.splunk.com/t5/Splunk-Search/Get-database-Size-per-day-and-Total-size-of-all-databases/m-p/304201#M162779 <P>I would like to get o/p as below <BR /> <IMG src="https://community.splunk.com/storage/temp/228842-untitled-2.png" alt="alt text" /></P> <P>I am using </P> <P>index=xxxx sourcetype="log" "Database =" AND "Size" host=xxxxx | eval date=strftime(_time, "%Y-%m-%d") |eval Size_MB = replace(Size,"MB","") | eval Size_MB = replace(Size,"MB","") |table date Database Size_MB | addtotals </P> <P>But it give Total per row instead of combining rows or toal of database per day.</P> Tue, 29 Sep 2020 18:09:48 GMT dpatiladobe 2020-09-29T18:09:48Z https://community.splunk.com/t5/Splunk-Search/Get-database-Size-per-day-and-Total-size-of-all-databases/m-p/304201#M162779 <P>I would like to get o/p as below <BR /> <IMG src="https://community.splunk.com/storage/temp/228842-untitled-2.png" alt="alt text" /></P> <P>I am using </P> <P>index=xxxx sourcetype="log" "Database =" AND "Size" host=xxxxx | eval date=strftime(_time, "%Y-%m-%d") |eval Size_MB = replace(Size,"MB","") | eval Size_MB = replace(Size,"MB","") |table date Database Size_MB | addtotals </P> <P>But it give Total per row instead of combining rows or toal of database per day.</P> Tue, 29 Sep 2020 18:09:48 GMT https://community.splunk.com/t5/Splunk-Search/Get-database-Size-per-day-and-Total-size-of-all-databases/m-p/304201#M162779 dpatiladobe 2020-09-29T18:09:48Z https://community.splunk.com/t5/Splunk-Search/Get-database-Size-per-day-and-Total-size-of-all-databases/m-p/304202#M162780 <P>Try this!</P> <PRE><CODE>index=xxxx sourcetype="log" "Database =" AND "Size" host=xxxxx |eval date=strftime(_time, "%Y-%m-%d") |eval Size_MB = replace(Size,"MB","") |table date Database Size_MB |streamstats count as No by Data |eventstats sum(size) as Total,max(No) as Max_No by date |eval Total=if(No=Max_No,Total,"") |table date Database Size_MB Total </CODE></PRE> Thu, 22 Feb 2018 05:52:37 GMT https://community.splunk.com/t5/Splunk-Search/Get-database-Size-per-day-and-Total-size-of-all-databases/m-p/304202#M162780 HiroshiSatoh 2018-02-22T05:52:37Z https://community.splunk.com/t5/Splunk-Search/Get-database-Size-per-day-and-Total-size-of-all-databases/m-p/304203#M162781 <P>You can try something like this </P> <PRE><CODE> index=xxxx sourcetype="log" "Database =" AND "Size" host=xxxxx |eval date=strftime(_time, "%Y-%m-%d") |eval Size_MB = replace(Size,"MB","") |convert num(Size_MB) as Size_MB |table date Database Size_MB |eventstats sum(Size_MB) as Total by date </CODE></PRE> <P>let me know if this helps!</P> Thu, 22 Feb 2018 06:07:41 GMT https://community.splunk.com/t5/Splunk-Search/Get-database-Size-per-day-and-Total-size-of-all-databases/m-p/304203#M162781 mayurr98 2018-02-22T06:07:41Z https://community.splunk.com/t5/Splunk-Search/Get-database-Size-per-day-and-Total-size-of-all-databases/m-p/304204#M162782 <P>The Total value is set for all rows and not as per the above. </P> Thu, 22 Feb 2018 16:28:48 GMT https://community.splunk.com/t5/Splunk-Search/Get-database-Size-per-day-and-Total-size-of-all-databases/m-p/304204#M162782 dpatiladobe 2018-02-22T16:28:48Z https://community.splunk.com/t5/Splunk-Search/Get-database-Size-per-day-and-Total-size-of-all-databases/m-p/304205#M162783 <P>The Total value is set for all rows and not as per the above. </P> Thu, 22 Feb 2018 16:28:54 GMT https://community.splunk.com/t5/Splunk-Search/Get-database-Size-per-day-and-Total-size-of-all-databases/m-p/304205#M162783 dpatiladobe 2018-02-22T16:28:54Z https://community.splunk.com/t5/Splunk-Search/Get-database-Size-per-day-and-Total-size-of-all-databases/m-p/304206#M162784 <P>Fix to display total on the last line.<BR /> I have never done it before ...</P> Fri, 23 Feb 2018 14:03:46 GMT https://community.splunk.com/t5/Splunk-Search/Get-database-Size-per-day-and-Total-size-of-all-databases/m-p/304206#M162784 HiroshiSatoh 2018-02-23T14:03:46Z