Splunk Enterprise

I need to get the average daily GB usage per index over 30 days

nls7010
Path Finder

I have been trying to put together a dashboard for my clients that shows their usage.  The search I am still having issues with is for Average Daily ingest by index over 30 days.  I want it to show just the average number.  I have found searches that get me a distance, but none are specifically what I need.

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
What is your current search?
---
If this reply helps you, Karma would be appreciated.
0 Karma

nls7010
Path Finder

This is the search:

index=_internal source=*license_usage.log* type="Usage" earliest=-30d@d latest=@d idx=apcne
| fields _time, pool, idx, b
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| bin _time span=24h
| stats sum(b) as b by _time, pool, idx
| stats sum(b) AS volume by idx, _time
| stats avg(volume) AS avgVolume max(volume) AS maxVolume by idx | eval avgVolumeGB=round(avgVolume/1024/1024/1024,2)
| eval maxVolumeGB=round(maxVolume/1024/1024/1024,2)
| fields idx, avgVolumeGB, maxVolumeGB
| rename avgVolumeGB AS "average" maxVolumeGB AS "peak" idx AS "Index"

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...