https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-so-it-shows-total-MB-per-user-for-the/m-p/202493#M58773 <P>See the updated answer...</P> Wed, 21 Sep 2016 20:20:06 GMT somesoni2 2016-09-21T20:20:06Z https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-so-it-shows-total-MB-per-user-for-the/m-p/202489#M58769 <PRE><CODE>bucket _time span=1d| eval _time = strftime(_time,"%b %d, %Y")| stats sum(eval(Bytes_Written/(1024*1024))) as MBytes_Moved, values(User_Name), values(MBytes_Moved) by _time </CODE></PRE> <P>Above is my current search, but only shows the total MB moved by all users. I want to show total MB moved, per user, for the day.</P> <P>What I am looking for would be:</P> <PRE><CODE>Date MBytes_Moved User Sept 20, 2016 2347 john.smith 4675 john.wagner 534 mike.smith 1215 pablo.johnson Sept 21, 2016 953 john.smith 3246 lonnie.murray 2312 max.effort Sept 22, 2016 2347 jason.adams 9087 john.doe 5876 william.shelton </CODE></PRE> <P>Thanks!</P> Tue, 20 Sep 2016 20:57:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-so-it-shows-total-MB-per-user-for-the/m-p/202489#M58769 cm22486 2016-09-20T20:57:21Z https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-so-it-shows-total-MB-per-user-for-the/m-p/202490#M58770 <P>Try this</P> <PRE><CODE>your base search | bucket _time span=1d| eval _time = strftime(_time,"%b %d, %Y")| stats sum(Bytes_Written) as MBytes_Moved by _time User_Name | eval MBytes_Moved=MBytes_Moved/(1024*1024) | stats sum(MBytes_Moved) as MBytes_Moved values(User_Name) values(MBytes_Moved) by _time </CODE></PRE> <P><STRONG>Updated#2 for File_Moved column</STRONG></P> <PRE><CODE>your base search | bucket _time span=1d| eval _time = strftime(_time,"%b %d, %Y")| stats sum(Bytes_Written) as MBytes_Moved count as File_Moved by _time User_Name | eval MBytes_Moved=MBytes_Moved/(1024*1024) | stats sum(MBytes_Moved) as MBytes_Moved list(User_Name) list(MBytes_Moved) list(File_Moved) as File_Moved by _time </CODE></PRE> Tue, 20 Sep 2016 21:28:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-so-it-shows-total-MB-per-user-for-the/m-p/202490#M58770 somesoni2 2016-09-20T21:28:31Z https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-so-it-shows-total-MB-per-user-for-the/m-p/202491#M58771 <PRE><CODE> bucket _time span=1d| eval _time = strftime(_time,"%b %d, %Y")| stats sum(eval(Bytes_Written/(1024*1024))) as MBytes_Moved by _time User_Name </CODE></PRE> Tue, 20 Sep 2016 21:59:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-so-it-shows-total-MB-per-user-for-the/m-p/202491#M58771 masonmorales 2016-09-20T21:59:14Z https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-so-it-shows-total-MB-per-user-for-the/m-p/202492#M58772 <P>Ahh we're close! Nice work and thank you! Last but not least, I forgot to include my "Files Moved" column in all of that. This is how I achieved "Files Moved" before, how could we append this?</P> <PRE><CODE>stats sum(eval(Bytes_Written/(1024*1024))) as MBytes_Moved, Count(_time) as Files_Moved by User_Name </CODE></PRE> Wed, 21 Sep 2016 19:47:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-so-it-shows-total-MB-per-user-for-the/m-p/202492#M58772 cm22486 2016-09-21T19:47:03Z https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-so-it-shows-total-MB-per-user-for-the/m-p/202493#M58773 <P>See the updated answer...</P> Wed, 21 Sep 2016 20:20:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-so-it-shows-total-MB-per-user-for-the/m-p/202493#M58773 somesoni2 2016-09-21T20:20:06Z https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-so-it-shows-total-MB-per-user-for-the/m-p/202494#M58774 <P><IMG src="http://imgur.com/a/eBfdX" alt="alt text" /></P> <P><A href="http://imgur.com/a/eBfdX">http://imgur.com/a/eBfdX</A></P> Wed, 21 Sep 2016 20:31:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-so-it-shows-total-MB-per-user-for-the/m-p/202494#M58774 cm22486 2016-09-21T20:31:39Z https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-so-it-shows-total-MB-per-user-for-the/m-p/202495#M58775 <P>That is a link to the screenshot of my results, we are so close, thanks for all the help.</P> Wed, 21 Sep 2016 20:32:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-so-it-shows-total-MB-per-user-for-the/m-p/202495#M58775 cm22486 2016-09-21T20:32:18Z https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-so-it-shows-total-MB-per-user-for-the/m-p/202496#M58776 <P>The values aggregation function remove duplicate values and there could very well be duplicate/same count of files moved. Instead of values function, use list function instead. I've updated the answer.</P> Wed, 21 Sep 2016 20:46:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-so-it-shows-total-MB-per-user-for-the/m-p/202496#M58776 somesoni2 2016-09-21T20:46:14Z https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-so-it-shows-total-MB-per-user-for-the/m-p/202497#M58777 <P>He shoots he scores! Thanks so much, you're a wizard.</P> Wed, 21 Sep 2016 20:50:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-modify-my-search-so-it-shows-total-MB-per-user-for-the/m-p/202497#M58777 cm22486 2016-09-21T20:50:32Z