topic Stats by date in Splunk Search

Stats by date

chris1 — Tue, 29 Sep 2020 09:28:59 GMT

Hi ,

I need the below splunk search to be shown in stats. Stats should be in date wise. please help.

| eventcount summarize=false report_size=true index=test| eval size_MB=size_bytes/(1024*1024) | eval size_GB=size_MB/1024

Thanks!

Re: Stats by date

martin_mueller — Sat, 23 Apr 2016 13:24:48 GMT

What do you mean by "shown in stats" and by "stats should be in date wise"?

Re: Stats by date

Abilan1 — Sat, 23 Apr 2016 13:40:31 GMT

I want to see the space consumed by the index per day.

Re: Stats by date

martin_mueller — Sat, 23 Apr 2016 14:24:21 GMT

The closest you can get to "space consumed by the index per day" is "space consumed by buckets of the index" and "bucket span":

| dbinspect index=main

That has startEpoch and endEpoch to give you the bucket span, and sizeOnDiskMB to give you the bucket's size. Since buckets can span weeks, how you count the per-day consumption depends on what your goals are.

Re: Stats by date

ddrillic — Mon, 25 Apr 2016 00:26:52 GMT

index=_internal source="/opt/splunk/var/log/splunk/license_usage.log*"
| timechart span=1d sum(eval(round(b/1024/1024/1024,5))) by idx

seems to do it...