Eval Usage data to percentage as 1d span base, and table today, 1month ago, 3months ago, 6months ago

[splunkkid]

Hello,

I'm trying to make time based table to check trend right away.

The data is currently accumulated on daily basis, which contains storage total GB, used GB per storage.

Now, I successfully made timechart that I can check trend of usage(used/  total * 100) data.

I made timechart viz with below command.

my base search
| eval usage = round('storage.used' / 'storage.total' * 100, 2)
| timechart span=1d limit=0 values(usage) by name

I want to make table that could show me usage data of today, 1month ago, 3months ago, 6months ago by storage. Like below. (Usage data must be calculated by used / total * 100 of the specific date.)

storage   used   total   usage(today)    usage(1mon)   usage(3mon)    usage(6mon)

A                 30      100     30                          27                        25                          23

...

Is there any way to make table such way?? Thank you.  

[ITWhisperer · Accepted solution]

Assuming your events are already daily, and it is not clear what your fields are actually called since you use a mixture of names, try something like this

my base search
| eval usage = round('storage.used' / 'storage.total' * 100, 2)
| bin _time span=1d
| where _time IN (relative_time(now(),"@d"), relative_time(now(),"-1mon@d"), relative_time(now(),"-3mon@d"), relative_time(now(),"-6mon@d")) 
| eval _time=case(_time=relative_time(now(),"@d"),"Today", _time=relative_time(now(),"-1mon@d"), "1mon", _time=relative_time(now(),"-3mon@d"), "3mon", _time=relative_time(now(),"-6mon@d"), "6mon")
| chart limit=0 values(usage) as usage values('storage.used') as used values('storage.total') as total by name _time 
| transpose 0
| where match(column,"(name|usage:|used: Today|total: Today)")
| rex field=column mode=sed "s/used:.*/used/g s/total:.*/total/g"
| transpose 0 header_field=column
| fields - column

[splunkkid]

Thank you for your help!

Since I'm in busy for other schedule, I will check this soon and come back to whether accept as solution