https://community.splunk.com/t5/Splunk-Search/Daily-averages-in-usage-over-7-days-or-similar/m-p/426523#M170715 <P>Give this a try</P> <PRE><CODE>index=_internal source="*license_usage.log*" type=Usage idx IN (index1,index2,index3, index4,etcindex) | eval yearmonthday=strftime(_time, "%m-%d-%Y") | stats sum(eval(round(b/1024/1024/1024,4))) AS volume_gb by idx yearmonthday | appendpipe [| stats avg(volume_gb) as volume_gb by idx | eval yearmonthday="ZZZZ" ] | chart sum(volume_gb) over idx by yearmonthday | sort -ZZZZ | rename "ZZZZ" as "Average GB" | addcoltotals labelfield=idx </CODE></PRE> Tue, 18 Jun 2019 14:14:32 GMT somesoni2 2019-06-18T14:14:32Z https://community.splunk.com/t5/Splunk-Search/Daily-averages-in-usage-over-7-days-or-similar/m-p/426521#M170713 <PRE><CODE>index=_internal source="*license_usage.log*" type=Usage idx IN (index1,index2,index3, index4,etcindex) | eval yearmonthday=strftime(_time, "%m-%d-%Y") | stats sum(eval(round(b/1024/1024/1024,4))) AS volume_gb by idx yearmonthday | chart sum(volume_gb) over idx by yearmonthday | addtotals col=true fieldname="Total GB" labelfield=idx </CODE></PRE> <P>The above works great showing me my daily index usage (have it set for the previous 7 full days)</P> <P>But I would much rather print the row total as averages instead of totals while keeping the column totals. Any idea? Additionally, how can I sort this by average size descending but keeping the total row at the bottom?</P> <P>Thank you</P> Sat, 15 Jun 2019 18:53:33 GMT https://community.splunk.com/t5/Splunk-Search/Daily-averages-in-usage-over-7-days-or-similar/m-p/426521#M170713 antb 2019-06-15T18:53:33Z https://community.splunk.com/t5/Splunk-Search/Daily-averages-in-usage-over-7-days-or-similar/m-p/426522#M170714 <P>Hello @antb,</P> <P>Please add below query at the end of your current search instead of using <CODE>addtotals</CODE> command.</P> <PRE><CODE>| appendpipe [| stats avg(*) as * | eval idx="Avg usage"] </CODE></PRE> <P>Hope this helps!!!</P> Tue, 18 Jun 2019 14:11:36 GMT https://community.splunk.com/t5/Splunk-Search/Daily-averages-in-usage-over-7-days-or-similar/m-p/426522#M170714 VatsalJagani 2019-06-18T14:11:36Z https://community.splunk.com/t5/Splunk-Search/Daily-averages-in-usage-over-7-days-or-similar/m-p/426523#M170715 <P>Give this a try</P> <PRE><CODE>index=_internal source="*license_usage.log*" type=Usage idx IN (index1,index2,index3, index4,etcindex) | eval yearmonthday=strftime(_time, "%m-%d-%Y") | stats sum(eval(round(b/1024/1024/1024,4))) AS volume_gb by idx yearmonthday | appendpipe [| stats avg(volume_gb) as volume_gb by idx | eval yearmonthday="ZZZZ" ] | chart sum(volume_gb) over idx by yearmonthday | sort -ZZZZ | rename "ZZZZ" as "Average GB" | addcoltotals labelfield=idx </CODE></PRE> Tue, 18 Jun 2019 14:14:32 GMT https://community.splunk.com/t5/Splunk-Search/Daily-averages-in-usage-over-7-days-or-similar/m-p/426523#M170715 somesoni2 2019-06-18T14:14:32Z