https://community.splunk.com/t5/Splunk-Search/How-do-I-create-and-display-a-trend-of-the-10-largest-database/m-p/266146#M80031 <P>I am setting up some trending. We currently collect stats on the largest tables and load them into Splunk. I am able to retrieve the 10 largest tables with the following search:</P> <PRE><CODE> sort - data_object_p_size | head 10 | eval TableName= tabschema."-". tabname | table TableName, data_object_p_size </CODE></PRE> <P>I would like to use the results from the search to include the table size over the last 90 days so I can gather the trend. Basically, I would like something like:</P> <P>TableName, Current Size, Size 30 days ago, Size 60 days ago, Size 90 days ago, Monthly growth</P> <P>Could someone point me in the direction of where to get started? Any help is greatly appreciated.</P> Wed, 07 Oct 2015 18:04:43 GMT treadyho 2015-10-07T18:04:43Z https://community.splunk.com/t5/Splunk-Search/How-do-I-create-and-display-a-trend-of-the-10-largest-database/m-p/266146#M80031 <P>I am setting up some trending. We currently collect stats on the largest tables and load them into Splunk. I am able to retrieve the 10 largest tables with the following search:</P> <PRE><CODE> sort - data_object_p_size | head 10 | eval TableName= tabschema."-". tabname | table TableName, data_object_p_size </CODE></PRE> <P>I would like to use the results from the search to include the table size over the last 90 days so I can gather the trend. Basically, I would like something like:</P> <P>TableName, Current Size, Size 30 days ago, Size 60 days ago, Size 90 days ago, Monthly growth</P> <P>Could someone point me in the direction of where to get started? Any help is greatly appreciated.</P> Wed, 07 Oct 2015 18:04:43 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-create-and-display-a-trend-of-the-10-largest-database/m-p/266146#M80031 treadyho 2015-10-07T18:04:43Z https://community.splunk.com/t5/Splunk-Search/How-do-I-create-and-display-a-trend-of-the-10-largest-database/m-p/266147#M80032 <P>There are multiple approaches you could take, but for a general discussion on how to combine search results from two (or more) time periods in one report, I would start <A href="http://blogs.splunk.com/2012/02/19/compare-two-time-ranges-in-one-report/">here</A>. You can extend this to support multiple time periods.</P> <P>If your data is such that you have one event per day, you can probably just use appendcols to retrieve your top10 values for 30,60,90 days. </P> Wed, 07 Oct 2015 18:28:53 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-create-and-display-a-trend-of-the-10-largest-database/m-p/266147#M80032 s2_splunk 2015-10-07T18:28:53Z https://community.splunk.com/t5/Splunk-Search/How-do-I-create-and-display-a-trend-of-the-10-largest-database/m-p/266148#M80033 <P>Ended up doing join, thanks for the help</P> Fri, 09 Oct 2015 13:16:16 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-create-and-display-a-trend-of-the-10-largest-database/m-p/266148#M80033 treadyho 2015-10-09T13:16:16Z