Splunk Search

How to calculate percentage increase/decrease for indexes per day?

jwalzerpitt
Influencer

How would I calculate the percentage increase/decrease, for indexes on a per-day basis?

Thx

codebuilder
Influencer

If you are using indexer discovery, this becomes very easy to solve.
On the cluster master UI, go to Settings > Monitoring Console (black bar) > Indexing (grey bar) > Index Detail: Deployment.

That interface will provide all the information you are seeking, and then some.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

codebuilder
Influencer

If this suggestion resolved your issue, please consider accepting the answer, as it benefits others.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

nickhills
Ultra Champion

Try this as a starting point:

(index=_internal source=*license_usage.log* type="Usage") 
| eval idx=if(((len(idx) == 0) OR isnull(idx)),"(UNKNOWN)",idx)
| search idx=YOURINDEXNAME
|  bin span=1d _time 
| stats sum(b) as bytes by _time,idx
| delta bytes as change
| eval perc=round((change/bytes)*100,2)
If my comment helps, please give it a thumbs up!
0 Karma

nickhills
Ultra Champion

Have you looked at the licensing reports? These will indicate the daily licence usage (volume indexed) for each index (or sourcetype).

If my comment helps, please give it a thumbs up!
0 Karma

jwalzerpitt
Influencer

I have, but there are no built-in searches/reports for % increase/decrease on a daily/monthly/etc basis

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Increase/decrease of what?

---
If this reply helps you, Karma would be appreciated.
0 Karma

jwalzerpitt
Influencer

Rich,

I've tried using timewrap, but I don't think I'm using it crrectly?

index=_internal source=*license_usage.log type="Usage" earliest=-1w@d 
| eval Date=strftime(_time, "%Y/%m/%d") 
| eventstats sum(b) as volume by idx, Date 
| eval GB=round(volume/1024/1024/1024,5)
| timechart first(GB) AS volume by idx
| timewrap 1w
0 Karma

jwalzerpitt
Influencer

sorry about that - of the index size growth/shrinkage

Thx

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...