Splunk Search

How to create a report that shows max indexed volume per day by month per index?

jedatt01
Builder

I need to create a report that shows max indexed volume per day by month per index. The following search gives me the indexing volume per day per index. How can modify this search to get what I need?

index=_internal source=license_usage.log type=Usage | timechart span=1d sum(eval(b/1024/1024/1024)) AS volume_b by idx

1 Solution

imrago
Contributor

index=_internal source=license_usage.log type=Usage | stats sum(eval(b/1024/1024/1024)) AS volume_b by idx date_mday date_month date_year | stats max(volume_b) by idx date_month date_year

View solution in original post

pacifikn
Communicator

How do I use this query to get the data in GB in readable format?

index=_internal source=*license_usage.log type=Usage | timechart span=1d sum(eval(b/1024/1024/1024)) AS volume_b by idx

 

- I also want to see how much data stored in all indexers per day, per month and per year? ,what is the query i can use?

Thank you in advance

0 Karma

imrago
Contributor

index=_internal source=license_usage.log type=Usage | stats sum(eval(b/1024/1024/1024)) AS volume_b by idx date_mday date_month date_year | stats max(volume_b) by idx date_month date_year

pacifikn
Communicator

index=_internal source=*license_usage.log type=Usage | stats sum(eval(b/1024/1024/1024)) AS volume_b by idx date_mday date_month date_year | stats max(volume_b) by idx date_month date_year

 

help me to edit this query to get the output in GB and also calculate the total number of all index in GB?

Thank you in advance

0 Karma

essklau
Path Finder

Question: This search doesn't work, but if I switch "idx" to "i", it gives me something. Is there a switch in recent splunk versions to the internal log format? EDIT: NM, idx is new field for v6+

0 Karma

mendesjo
Path Finder

another query posted that doesn't work.. at least for me.. changing idx to i also gives no results found 😞

0 Karma

marciniega
Explorer

This worked for me, but I had to use source="*license_usage.log", with the asterisk wildcard for the preceding file path characters.

0 Karma

jedatt01
Builder

You rock!!

0 Karma

imrago
Contributor

index=_internal source=license_usage.log type=Usage | eval yearmonthday=strftime(_time, "%Y%m%d") | eval yearmonth=strftime(_time, "%Y%m") | stats sum(eval(b/1024/1024/1024)) AS volume_b by idx yearmonthday yearmonth | chart max(volume_b) over yearmonth by idx

jedatt01
Builder

Ok that works, but how can I get it in a more readable format?I'd like to have the indexes as columns across the top and each months values as rows. Basically, I timechart by index

0 Karma

sridhar_venna
New Member

Is it MB or GB ?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...