Using Splunk Enterprise Search and Reporting

[maryamchar]

hello,

I would like to show my daily usage of Splunk Volume, but also have a second graph represent how much it will be needed for 6 months volume with total.

[iamarkaprabha]

Hi ,

can you use this

 **index=_internal source=*metrics.log group="per_host_thruput" | eval GB=kb/1048576 | timechart sum(GB) as "total" by series span=1mon limit=0 | appendpipe [stats avg(*) as *]**

and set the time frame on your search for last six months

[maryamchar]

My question is i want to show how much storage i need for the next 6 months and i know amount already in GB which is 10,115 GB. Now i want to make a graph and show how much i use daily and show that i haven't reached that amount for 6 months yet, How would i do that ??? And represent that in visualization

[iamarkaprabha]

use this

  **index=_internal source=*metrics.log group="per_host_thruput" | eval GB=kb/1048576 | timechart sum(GB) as "total" by series span=1d limit=0 | appendpipe [stats avg(*) as *]**

[maryamchar]

That's what i have originally and i asked the question because i'm trying to find volume for 6 months

[iamarkaprabha]

You can use earliest and latest command to isolate the data of 6 month's

[maryamchar]

I want to write a query to show how much volume usage will i need for next 6 months. I already know the exact amount that need for 6 months which is 10,115GB. But i would like to show my daily usage and show that i haven't reached that 6 months amount yet, For example show that i used 50.00/10,115 GB

[iamarkaprabha]

Oh sorry . For next 6 month's , you have to use machine learning. There is a app called ML toolkit. By which you are write various regression techniques and show future data. Or there is a command called predict , you can use that also