Hi ,
I need the below splunk search to be shown in stats. Stats should be in date wise. please help.
| eventcount summarize=false report_size=true index=test| eval size_MB=size_bytes/(1024*1024) | eval size_GB=size_MB/1024
Thanks!
The closest you can get to "space consumed by the index per day" is "space consumed by buckets of the index" and "bucket span":
| dbinspect index=main
That has startEpoch
and endEpoch
to give you the bucket span, and sizeOnDiskMB
to give you the bucket's size. Since buckets can span weeks, how you count the per-day consumption depends on what your goals are.
What do you mean by "shown in stats" and by "stats should be in date wise"?
I want to see the space consumed by the index per day.
index=_internal source="/opt/splunk/var/log/splunk/license_usage.log*"
| timechart span=1d sum(eval(round(b/1024/1024/1024,5))) by idx
seems to do it...