https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-check-the-amount-of-data-indexed-by-my/m-p/136083#M37226 <P>@Iguinn <BR /> I have a doubt... When I added the query "index=_internal sourcetype=splunkd group=per_host_thruput | timechart per_second(kb) by series" to the dashboard made a default time range of 365 days, I get a different graph and when I run it for All time it is different. Although the data is only there starting march. Any idea why? </P> Mon, 28 Sep 2020 19:29:29 GMT sushmitha_mj 2020-09-28T19:29:29Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-check-the-amount-of-data-indexed-by-my/m-p/136080#M37223 <P>Hi, </P> <P>I want to a graph to check the amount of data indexed by my app on each day for a certain time period. I have multiple csv files in the source, one host and an index ( not default, I created this ). I used </P> <PRE><CODE>index="abc" | eval MB=kb/1024 | search group="per_sourcetype_thruput" | timechart span=1d sum(MB) by series </CODE></PRE> <P>and</P> <PRE><CODE>index="abc" group="per_index_thruput" | timechart per_second(kb) as " kbps" by series </CODE></PRE> <P>but they seem to return no results. </P> Mon, 06 Apr 2015 18:04:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-check-the-amount-of-data-indexed-by-my/m-p/136080#M37223 sushmitha_mj 2015-04-06T18:04:21Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-check-the-amount-of-data-indexed-by-my/m-p/136081#M37224 <P>The groups that you are looking for are not in the "abc" index - they are in the <CODE>_internal</CODE> index. Also, you can get the "per index" through-put by index, or the "per sourcetype" through-put by sourcetype - but you can't get the "per index" through-put by sourcetype!</P> <PRE><CODE>index=_internal sourcetype=splunkd group=per_sourcetype_thruput | eval MB=kb/1024 | timechart span=1d sum(MB) by series index=_internal sourcetype=splunkd group=per_index_thruput series="abc" |timechart per_second(kb) as " kbps" </CODE></PRE> <P>HTH</P> Mon, 06 Apr 2015 19:28:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-check-the-amount-of-data-indexed-by-my/m-p/136081#M37224 lguinn2 2015-04-06T19:28:03Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-check-the-amount-of-data-indexed-by-my/m-p/136082#M37225 <P>@Iguinn<BR /> Thank you... <BR /> Both worked, and I had an option of entering the series on the first one as well. As the graph itself was multiple series lines. </P> Mon, 06 Apr 2015 20:52:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-check-the-amount-of-data-indexed-by-my/m-p/136082#M37225 sushmitha_mj 2015-04-06T20:52:45Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-check-the-amount-of-data-indexed-by-my/m-p/136083#M37226 <P>@Iguinn <BR /> I have a doubt... When I added the query "index=_internal sourcetype=splunkd group=per_host_thruput | timechart per_second(kb) by series" to the dashboard made a default time range of 365 days, I get a different graph and when I run it for All time it is different. Although the data is only there starting march. Any idea why? </P> Mon, 28 Sep 2020 19:29:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-check-the-amount-of-data-indexed-by-my/m-p/136083#M37226 sushmitha_mj 2020-09-28T19:29:29Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-check-the-amount-of-data-indexed-by-my/m-p/136084#M37227 <P>Well, if you run the same search twice, you will get different results usually, as the data is always changing.<BR /> But, there is also the problem of the first/final "grouping" of the data - if the data is only partial days, it can look weird. And different timeranges can certainly make the graph look different.</P> <P>I would probably set the search time range explicitly to something like earliest=-30d@d latest=@d to avoid the problem of partial buckets. Or, if you want to be able to pick the timerange each time you run the report, do this in the timechart command:</P> <PRE><CODE>timechart fixedrange=f partial=f per_second(kb) as " kbps" </CODE></PRE> <P>This will restrict the graph to only the part of the timerange with valid data and also remove any partial buckets.</P> Thu, 09 Apr 2015 20:17:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-check-the-amount-of-data-indexed-by-my/m-p/136084#M37227 lguinn2 2015-04-09T20:17:07Z