I would like to compare total throughput for two dates 60 days apart (say, current and -60d). The query in the CMC that generates the throughput is
index=_internal (host=`sim_indexer_url` OR host=`sim_si_url`) sourcetype=splunkd group=per_Index_thruput series!=_*
| timechart minspan=30s per_second(kb) as kb by series
I need the series information, but it could be binned into 1 whole day.
90 days
So what is the time of your earliest event?
Try something like this
index=_internal (host=`sim_indexer_url` OR host=`sim_si_url`) sourcetype=splunkd group=per_Index_thruput series!=_* (earliest=@d latest=now) OR (earliest=-60d@d latest=-59d@d)
| timechart minspan=30s per_second(kb) as kb by series
Hi this doesn't work; I'm not getting anything for the earlier dates (and I have expanded the date range to two days before the -60 date and today).
What is the retention period on your index or the earliest event in your index?