Splunk Search

How can I produce results with a span of 1 day and span for every 1st of the month?

Gowtham0809
New Member

I User the below search to identify the usage of disk for 1 day(Previous day).

earliest=-2d index="A" source="PerfmonMk:Free Disk Space" "%_Free_Space"="*" E | eval volume=Free_Megabytes/1024 | chart avg(volume) | rename avg(volume) as Volume1 | join type=left [search earliest=-1d index="A" source="PerfmonMk:Free Disk Space" "%_Free_Space"="*" E | eval volume=Free_Megabytes/1024 | chart avg(volume) | rename avg(volume) as Volume2]  | eval difference=(Volume1-Volume2) 

I need to get this data on a daily basis to generate a monthly report.

Would someone help me in doing the same using the time span command?

Thanks,

Tags (3)
0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @Gowtham0809

Does this do what you are wanting:

earliest=-1mon@mon index="A" source="PerfmonMk:Free Disk Space" "%_Free_Space"="" E | eval volume=Free_Megabytes/1024 | timechart span=1d avg(volume) as volume

Hope this helps.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...