topic Re: Generating a daily, weekly and monthly report for indexed volume usage by all indexes and all servers. in Splunk Search

Generating a daily, weekly and monthly report for indexed volume usage by all indexes and all servers.

mike7860 — Mon, 05 Nov 2012 18:31:00 GMT

I would like to generate a daily, weekly and monthly report for indexed volume usage by all indexes and all servers. I would like to add the usage daily , weekly and monthly as three individual columns. Is it possible to merge the results in splunk search head? I generated a report for daily indexed volume usage, but unable to add a column comparing the indexed usage weekly, monthly etc.

Re: Generating a daily, weekly and monthly report for indexed volume usage by all indexes and all servers.

sowings — Mon, 28 Sep 2020 12:45:00 GMT

I'd approach this by using eventstats. I'd create fields by using strftime using %m for month, and %U (or %V or %W—see man pages for which you prefer) for week (number). Then, another for %j for day number. Next, I'd use eventstats to sum or count or whatever "by day_number', then "by week_number", then finally another invocation for "by month". You're required to use an "AS" clause with eventstats, so ultimately, your search might look like this:

<your search>
| eval day_no=strftime(_time, "%j")
| eval week_no=strftime(_time, "%U")
| eval month_no=strftime(_time, "%m")
| eventstats sum(kb) AS daily by day_no
| eventstats sum(kb) AS weekly by week_no
| eventstats sum(kb) AS monthly by month_no
<display functions>

The event set would carry day_no, week_no and year_no fields along with every event, so you'd have those numbers available to pass to chart or timechart or stats.

Re: Generating a daily, weekly and monthly report for indexed volume usage by all indexes and all servers.

sowings — Tue, 06 Nov 2012 01:41:27 GMT

Er, sorry, I misread monthly as yearly. Edited the above to reflect that change.