Help with previous weeks index totals by day Report

[plarsenDST]

I have this report for license usage for one day emailed to me daily, that shows totals by index and a daily total.

I want a report with this same format repeated/listed 5 times showing the previous weeks days Mon-Friday and I'm not sure how to accomplish it.

A manager report so they can see daily totals for the previous week emailed out on Monday AM. The email and schedule part is not the issue for me. Just the SPL learning curve.

index=_internal earliest=-1d@d latest=-0d@d source=*license_usage.log* type=Usage | bucket span=1d _time | stats sum(b) as bytes by _time idx | eval gb=round(bytes/1024/1024/1024,3) | addtotals row=false col=true | rename idx as Index | rename gb as "Total GB"

[plarsenDST]

I think this will work.. I had to change latest=-1w@w5
to -0 for it to run correctly. - Thanks for the help.

 index=_internal earliest=-1w@w1 latest=-0w@w5 source=*license_usage.log* type=Usage | bucket span=1d _time | stats sum(b) as bytes by _time idx | eval gb=round(bytes/1024/1024/1024,3) | appendpipe [| stats sum(gb) as gb by _time | eval idx="ZZZZZ"] | sort _time idx | rename idx as Index | rename gb as "Total GB" | eval Index=if(Index="ZZZZZ","Total For Day",Index)

[somesoni2 · Accepted solution]

Give this a try

 index=_internal earliest=-1w@w1 latest=-1w@w5 source=*license_usage.log* type=Usage | bucket span=1d _time | stats sum(b) as bytes by _time idx | eval gb=round(bytes/1024/1024/1024,3) | appendpipe [| stats sum(gb) as gb by _time | eval idx="ZZZZZ"] | sort _time idx | rename idx as Index | rename gb as "Total GB" | eval Index=if(Index="ZZZZZ","Total For Day",Index)