I have been trying to put together a dashboard for my clients that shows their usage. The search I am still having issues with is for Average Daily ingest by index over 30 days. I want it to show just the average number. I have found searches that get me a distance, but none are specifically what I need.
This is the search:
index=_internal source=*license_usage.log* type="Usage" earliest=-30d@d latest=@d idx=apcne
| fields _time, pool, idx, b
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| bin _time span=24h
| stats sum(b) as b by _time, pool, idx
| stats sum(b) AS volume by idx, _time
| stats avg(volume) AS avgVolume max(volume) AS maxVolume by idx | eval avgVolumeGB=round(avgVolume/1024/1024/1024,2)
| eval maxVolumeGB=round(maxVolume/1024/1024/1024,2)
| fields idx, avgVolumeGB, maxVolumeGB
| rename avgVolumeGB AS "average" maxVolumeGB AS "peak" idx AS "Index"