topic Sum Total File Size By Year in Splunk Search https://community.splunk.com/t5/Splunk-Search/Sum-Total-File-Size-By-Year/m-p/198090#M57260 <P>I have the following data:</P> <TABLE style="width:300px"> <TBODY><TR> <TD>Time</TD> <TD>FileName</TD> <TD>FileSize</TD> </TR> <TR> <TD>5/4/2010</TD> <TD>stuff.txt</TD> <TD>151</TD> </TR> <TR> <TD>7/15/2010</TD> <TD>whatever.txt</TD> <TD>252</TD> </TR> <TR> <TD>6/5/2011</TD> <TD>things.txt</TD> <TD>353</TD> </TR> <TR> <TD>6/7/2012</TD> <TD>yes.txt</TD> <TD>454</TD> </TR> <TR> <TD>8/5/2012</TD> <TD>no.txt</TD> <TD>555</TD> </TR> <TR> <TD>9/10/2013</TD> <TD>blah.txt</TD> <TD>656</TD> </TR> </TBODY></TABLE> <P><BR /><BR /> What I need is an output showing the number of files from each year and the total size of files from that year. I got the first part by doing:</P> <P>index=temp_index | stats count by date_year</P> <P>This outputs:</P> <TABLE style="width:200px"> <TBODY><TR> <TD>Date_Year</TD> <TD>Count</TD> </TR> <TR> <TD>2010</TD> <TD>2</TD> </TR> <TR> <TD>2011</TD> <TD>1</TD> </TR> <TR> <TD>2012</TD> <TD>2</TD> </TR> <TR> <TD>2013</TD> <TD>1</TD> </TR> </TBODY></TABLE> <P><BR /><BR /> What I need is a third column that adds the total file sizes for each year so:</P> <TABLE style="width:300px"> <TBODY><TR> <TD>Date_Year</TD> <TD>Count</TD> <TD>TotalFileSize</TD> </TR> <TR> <TD>2010</TD> <TD>2</TD> <TD>403</TD> </TR> <TR> <TD>2011</TD> <TD>1</TD> <TD>353</TD> </TR> <TR> <TD>2012</TD> <TD>2</TD> <TD>1009</TD> </TR> <TR> <TD>2013</TD> <TD>1</TD> <TD>656</TD> </TR> </TBODY></TABLE> Mon, 28 Sep 2020 16:51:34 GMT caviman2201 2020-09-28T16:51:34Z Sum Total File Size By Year https://community.splunk.com/t5/Splunk-Search/Sum-Total-File-Size-By-Year/m-p/198090#M57260 <P>I have the following data:</P> <TABLE style="width:300px"> <TBODY><TR> <TD>Time</TD> <TD>FileName</TD> <TD>FileSize</TD> </TR> <TR> <TD>5/4/2010</TD> <TD>stuff.txt</TD> <TD>151</TD> </TR> <TR> <TD>7/15/2010</TD> <TD>whatever.txt</TD> <TD>252</TD> </TR> <TR> <TD>6/5/2011</TD> <TD>things.txt</TD> <TD>353</TD> </TR> <TR> <TD>6/7/2012</TD> <TD>yes.txt</TD> <TD>454</TD> </TR> <TR> <TD>8/5/2012</TD> <TD>no.txt</TD> <TD>555</TD> </TR> <TR> <TD>9/10/2013</TD> <TD>blah.txt</TD> <TD>656</TD> </TR> </TBODY></TABLE> <P><BR /><BR /> What I need is an output showing the number of files from each year and the total size of files from that year. I got the first part by doing:</P> <P>index=temp_index | stats count by date_year</P> <P>This outputs:</P> <TABLE style="width:200px"> <TBODY><TR> <TD>Date_Year</TD> <TD>Count</TD> </TR> <TR> <TD>2010</TD> <TD>2</TD> </TR> <TR> <TD>2011</TD> <TD>1</TD> </TR> <TR> <TD>2012</TD> <TD>2</TD> </TR> <TR> <TD>2013</TD> <TD>1</TD> </TR> </TBODY></TABLE> <P><BR /><BR /> What I need is a third column that adds the total file sizes for each year so:</P> <TABLE style="width:300px"> <TBODY><TR> <TD>Date_Year</TD> <TD>Count</TD> <TD>TotalFileSize</TD> </TR> <TR> <TD>2010</TD> <TD>2</TD> <TD>403</TD> </TR> <TR> <TD>2011</TD> <TD>1</TD> <TD>353</TD> </TR> <TR> <TD>2012</TD> <TD>2</TD> <TD>1009</TD> </TR> <TR> <TD>2013</TD> <TD>1</TD> <TD>656</TD> </TR> </TBODY></TABLE> Mon, 28 Sep 2020 16:51:34 GMT https://community.splunk.com/t5/Splunk-Search/Sum-Total-File-Size-By-Year/m-p/198090#M57260 caviman2201 2020-09-28T16:51:34Z Re: Sum Total File Size By Year https://community.splunk.com/t5/Splunk-Search/Sum-Total-File-Size-By-Year/m-p/198091#M57261 <P>Try this:</P> <PRE><CODE>index=temp_index | stats count sum(FileSize) by date_year </CODE></PRE> Fri, 13 Jun 2014 21:11:11 GMT https://community.splunk.com/t5/Splunk-Search/Sum-Total-File-Size-By-Year/m-p/198091#M57261 martin_mueller 2014-06-13T21:11:11Z