How to calculate percentage increase/decrease for indexes per day?

[jwalzerpitt]

How would I calculate the percentage increase/decrease, for indexes on a per-day basis?

Thx

[codebuilder]

If you are using indexer discovery, this becomes very easy to solve.
On the cluster master UI, go to Settings > Monitoring Console (black bar) > Indexing (grey bar) > Index Detail: Deployment.

That interface will provide all the information you are seeking, and then some.

[codebuilder]

If this suggestion resolved your issue, please consider accepting the answer, as it benefits others.

[nickhills]

Try this as a starting point:

(index=_internal source=*license_usage.log* type="Usage") 
| eval idx=if(((len(idx) == 0) OR isnull(idx)),"(UNKNOWN)",idx)
| search idx=YOURINDEXNAME
|  bin span=1d _time 
| stats sum(b) as bytes by _time,idx
| delta bytes as change
| eval perc=round((change/bytes)*100,2)

[nickhills]

Have you looked at the licensing reports? These will indicate the daily licence usage (volume indexed) for each index (or sourcetype).

[jwalzerpitt]

I have, but there are no built-in searches/reports for % increase/decrease on a daily/monthly/etc basis

[richgalloway]

Increase/decrease of what?

[jwalzerpitt]

Rich,

I've tried using timewrap, but I don't think I'm using it crrectly?

index=_internal source=*license_usage.log type="Usage" earliest=-1w@d 
| eval Date=strftime(_time, "%Y/%m/%d") 
| eventstats sum(b) as volume by idx, Date 
| eval GB=round(volume/1024/1024/1024,5)
| timechart first(GB) AS volume by idx
| timewrap 1w

[jwalzerpitt]

sorry about that - of the index size growth/shrinkage

Thx