Splunk Search

How can I produce results with a span of 1 day and span for every 1st of the month?

Gowtham0809
New Member

I User the below search to identify the usage of disk for 1 day(Previous day).

earliest=-2d index="A" source="PerfmonMk:Free Disk Space" "%_Free_Space"="*" E | eval volume=Free_Megabytes/1024 | chart avg(volume) | rename avg(volume) as Volume1 | join type=left [search earliest=-1d index="A" source="PerfmonMk:Free Disk Space" "%_Free_Space"="*" E | eval volume=Free_Megabytes/1024 | chart avg(volume) | rename avg(volume) as Volume2]  | eval difference=(Volume1-Volume2) 

I need to get this data on a daily basis to generate a monthly report.

Would someone help me in doing the same using the time span command?

Thanks,

Tags (3)
0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @Gowtham0809

Does this do what you are wanting:

earliest=-1mon@mon index="A" source="PerfmonMk:Free Disk Space" "%_Free_Space"="" E | eval volume=Free_Megabytes/1024 | timechart span=1d avg(volume) as volume

Hope this helps.

0 Karma
Get Updates on the Splunk Community!

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...