How to get a search to show indexed data by index per day?

[dolfantimmy]

I realize this is yet another newbie question, but I need a search to show me indexed data, by index, per day. Does this exist in SOS or elsewhere? Ideas?

[aljohnson_splun · Accepted solution]

This is in SOS.

Just click on view results on the bottom to get into the data itself.

[dolfantimmy]

I think that will do it! Thanks

[mendesjo]

Only shows top 10, how do you get all of them?

[pgreer_splunk]

The search that is run behind the scenes in S.O.S. is essentially:

 index=_internal host="*" source=*metrics.log group="per_index_thruput"
            | bin _time 
            | stats sum(kb) AS KB by series,_time
            | timechart minspan=30s  sum(eval(round(KB/1024/1024,2))) by series

Does that give you what you need? - assuming the time span is selected for what you're looking for (aka yesterday, last week, etc.)

[mendesjo]

Hi yes, when I click on "open in search" that's the query, but where in that query are they speciifying only to return top 10? How do I modify that query to include all of indexes, or if I wanted to filter for a particuliar index? Thanks in advance.

[mendesjo]

Anyone? How do you show more than the 10 indexes?

[mendesjo]

Excellent!