Splunk Enterprise

I need to get the average daily GB usage per index over 30 days

nls7010
Path Finder

I have been trying to put together a dashboard for my clients that shows their usage.  The search I am still having issues with is for Average Daily ingest by index over 30 days.  I want it to show just the average number.  I have found searches that get me a distance, but none are specifically what I need.

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
What is your current search?
---
If this reply helps you, Karma would be appreciated.
0 Karma

nls7010
Path Finder

This is the search:

index=_internal source=*license_usage.log* type="Usage" earliest=-30d@d latest=@d idx=apcne
| fields _time, pool, idx, b
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| bin _time span=24h
| stats sum(b) as b by _time, pool, idx
| stats sum(b) AS volume by idx, _time
| stats avg(volume) AS avgVolume max(volume) AS maxVolume by idx | eval avgVolumeGB=round(avgVolume/1024/1024/1024,2)
| eval maxVolumeGB=round(maxVolume/1024/1024/1024,2)
| fields idx, avgVolumeGB, maxVolumeGB
| rename avgVolumeGB AS "average" maxVolumeGB AS "peak" idx AS "Index"

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...