Splunk Search

How to create a report that shows max indexed volume per day by month per index?

jedatt01
Builder

I need to create a report that shows max indexed volume per day by month per index. The following search gives me the indexing volume per day per index. How can modify this search to get what I need?

index=_internal source=license_usage.log type=Usage | timechart span=1d sum(eval(b/1024/1024/1024)) AS volume_b by idx

1 Solution

imrago
Contributor

index=_internal source=license_usage.log type=Usage | stats sum(eval(b/1024/1024/1024)) AS volume_b by idx date_mday date_month date_year | stats max(volume_b) by idx date_month date_year

View solution in original post

imrago
Contributor

index=_internal source=license_usage.log type=Usage | stats sum(eval(b/1024/1024/1024)) AS volume_b by idx date_mday date_month date_year | stats max(volume_b) by idx date_month date_year

View solution in original post

essklau
Path Finder

Question: This search doesn't work, but if I switch "idx" to "i", it gives me something. Is there a switch in recent splunk versions to the internal log format? EDIT: NM, idx is new field for v6+

0 Karma

mendesjo
Explorer

another query posted that doesn't work.. at least for me.. changing idx to i also gives no results found 😞

0 Karma

marciniega
Explorer

This worked for me, but I had to use source="*license_usage.log", with the asterisk wildcard for the preceding file path characters.

0 Karma

jedatt01
Builder

You rock!!

0 Karma

imrago
Contributor

index=_internal source=license_usage.log type=Usage | eval yearmonthday=strftime(_time, "%Y%m%d") | eval yearmonth=strftime(_time, "%Y%m") | stats sum(eval(b/1024/1024/1024)) AS volume_b by idx yearmonthday yearmonth | chart max(volume_b) over yearmonth by idx

jedatt01
Builder

Ok that works, but how can I get it in a more readable format?I'd like to have the indexes as columns across the top and each months values as rows. Basically, I timechart by index

0 Karma

sridhar_venna
New Member

Is it MB or GB ?

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!