Splunk Search
Highlighted

How to calculate percentage increase/decrease for indexes per day?

Motivator

How would I calculate the percentage increase/decrease, for indexes on a per-day basis?

Thx

Highlighted

Re: How to calculate percentage increase/decrease for indexes per day?

SplunkTrust
SplunkTrust

Increase/decrease of what?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How to calculate percentage increase/decrease for indexes per day?

Motivator

sorry about that - of the index size growth/shrinkage

Thx

0 Karma
Highlighted

Re: How to calculate percentage increase/decrease for indexes per day?

Motivator

Rich,

I've tried using timewrap, but I don't think I'm using it crrectly?

index=_internal source=*license_usage.log type="Usage" earliest=-1w@d 
| eval Date=strftime(_time, "%Y/%m/%d") 
| eventstats sum(b) as volume by idx, Date 
| eval GB=round(volume/1024/1024/1024,5)
| timechart first(GB) AS volume by idx
| timewrap 1w
0 Karma
Highlighted

Re: How to calculate percentage increase/decrease for indexes per day?

Ultra Champion

Have you looked at the licensing reports? These will indicate the daily licence usage (volume indexed) for each index (or sourcetype).

0 Karma
Highlighted

Re: How to calculate percentage increase/decrease for indexes per day?

Motivator

I have, but there are no built-in searches/reports for % increase/decrease on a daily/monthly/etc basis

0 Karma
Highlighted

Re: How to calculate percentage increase/decrease for indexes per day?

Ultra Champion

Try this as a starting point:

(index=_internal source=*license_usage.log* type="Usage") 
| eval idx=if(((len(idx) == 0) OR isnull(idx)),"(UNKNOWN)",idx)
| search idx=YOURINDEXNAME
|  bin span=1d _time 
| stats sum(b) as bytes by _time,idx
| delta bytes as change
| eval perc=round((change/bytes)*100,2)
0 Karma
Highlighted

Re: How to calculate percentage increase/decrease for indexes per day?

Motivator

If you are using indexer discovery, this becomes very easy to solve.
On the cluster master UI, go to Settings > Monitoring Console (black bar) > Indexing (grey bar) > Index Detail: Deployment.

That interface will provide all the information you are seeking, and then some.

0 Karma
Highlighted

Re: How to calculate percentage increase/decrease for indexes per day?

Motivator

If this suggestion resolved your issue, please consider accepting the answer, as it benefits others.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.