Splunk Search

Generating a daily, weekly and monthly report for indexed volume usage by all indexes and all servers.

mike7860
Explorer

I would like to generate a daily, weekly and monthly report for indexed volume usage by all indexes and all servers. I would like to add the usage daily , weekly and monthly as three individual columns. Is it possible to merge the results in splunk search head? I generated a report for daily indexed volume usage, but unable to add a column comparing the indexed usage weekly, monthly etc.

Tags (1)
0 Karma

sowings
Splunk Employee
Splunk Employee

I'd approach this by using eventstats. I'd create fields by using strftime using %m for month, and %U (or %V or %W—see man pages for which you prefer) for week (number). Then, another for %j for day number. Next, I'd use eventstats to sum or count or whatever "by day_number', then "by week_number", then finally another invocation for "by month". You're required to use an "AS" clause with eventstats, so ultimately, your search might look like this:

<your search>
| eval day_no=strftime(_time, "%j")
| eval week_no=strftime(_time, "%U")
| eval month_no=strftime(_time, "%m")
| eventstats sum(kb) AS daily by day_no
| eventstats sum(kb) AS weekly by week_no
| eventstats sum(kb) AS monthly by month_no
<display functions>

The event set would carry day_no, week_no and year_no fields along with every event, so you'd have those numbers available to pass to chart or timechart or stats.

0 Karma

sowings
Splunk Employee
Splunk Employee

Er, sorry, I misread monthly as yearly. Edited the above to reflect that change.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...