https://community.splunk.com/t5/Splunk-Search/If-I-want-to-gather-the-statistics-day-by-day-for-seeing-the/m-p/471448#M192254 <P>thanks @to4kawa, its work !</P> Tue, 18 Feb 2020 02:20:36 GMT ctksplunkctk 2020-02-18T02:20:36Z https://community.splunk.com/t5/Splunk-Search/If-I-want-to-gather-the-statistics-day-by-day-for-seeing-the/m-p/471446#M192252 <P>Hi all,<BR /> I have search through the questions asked regarding caption question and find below query. If I want to gather the statistics day by day for seeing the trend of each type of data and for checking the usage of any new data on-board in the future.<BR /> How should I modify the query?<BR /> Thanks for the help in advance.<BR /> Ricky</P> <OL> <LI> index=_internal source=*license_usage.log type="Usage" </LI> <LI> | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)</LI> <LI> | eval sourcetypename = st</LI> <LI> | bin _time span=1d </LI> <LI> | stats sum(b) as b by _time, pool, indexname, sourcetypename</LI> <LI> | eval GB=round(b/1024/1024/1024, 3)</LI> <LI> | fields _time, indexname, sourcetypename, GB</LI> </OL> Wed, 30 Sep 2020 04:11:20 GMT https://community.splunk.com/t5/Splunk-Search/If-I-want-to-gather-the-statistics-day-by-day-for-seeing-the/m-p/471446#M192252 ctksplunkctk 2020-09-30T04:11:20Z https://community.splunk.com/t5/Splunk-Search/If-I-want-to-gather-the-statistics-day-by-day-for-seeing-the/m-p/471447#M192253 <PRE><CODE>index=_internal source=*license_usage.log type="Usage" | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | eval sourcetypename = st | bin _time span=1d | stats sum(b) as b by _time, pool, indexname, sourcetypename | eval GB=round(b/1024/1024/1024, 3) | fields _time, indexname, sourcetypename, GB | eval index_sourcetype=indexname.":".sourcetypename | xyseries _time index_sourcetype GB | fillnull value=0.000 </CODE></PRE> <P>Hi, @ctksplunkctk<BR /> How about this?</P> Sun, 16 Feb 2020 09:46:24 GMT https://community.splunk.com/t5/Splunk-Search/If-I-want-to-gather-the-statistics-day-by-day-for-seeing-the/m-p/471447#M192253 to4kawa 2020-02-16T09:46:24Z https://community.splunk.com/t5/Splunk-Search/If-I-want-to-gather-the-statistics-day-by-day-for-seeing-the/m-p/471448#M192254 <P>thanks @to4kawa, its work !</P> Tue, 18 Feb 2020 02:20:36 GMT https://community.splunk.com/t5/Splunk-Search/If-I-want-to-gather-the-statistics-day-by-day-for-seeing-the/m-p/471448#M192254 ctksplunkctk 2020-02-18T02:20:36Z