Splunk Search

How to search for average data indexed over 30, 60, 90 days by index?

matthew_foos
Path Finder

Splunkers,

Looking for a search string that will allow me to use the time picker to see how much data has been indexed over 30, 60, 90, etc days by index. I tried a few searches but had no luck.

Any help would be greatly appreciated.

Thanks

0 Karma
1 Solution

althomas
Communicator

So this is an example over three days, but this should vaguely work for your purposes. I've only focused on one index for demonstrative purposes.

Change hours to months (-3mon@mon and @mon) or 30 days (-90d@d, @d, bin _time span=30d) for this to work

index=_internal source=*license_usage.log* idx=my_index earliest=-3h@h latest=@h
| bin _time span=1h
| stats sum(b) as bytes by idx, _time
| reverse
| streamstats sum(bytes) as total_bytes by idx
| timechart values(total_bytes) by idx span=1h

Hope this helps!

Edit: Used accum instead of streamstats -- this should work now.

View solution in original post

0 Karma

althomas
Communicator

So this is an example over three days, but this should vaguely work for your purposes. I've only focused on one index for demonstrative purposes.

Change hours to months (-3mon@mon and @mon) or 30 days (-90d@d, @d, bin _time span=30d) for this to work

index=_internal source=*license_usage.log* idx=my_index earliest=-3h@h latest=@h
| bin _time span=1h
| stats sum(b) as bytes by idx, _time
| reverse
| streamstats sum(bytes) as total_bytes by idx
| timechart values(total_bytes) by idx span=1h

Hope this helps!

Edit: Used accum instead of streamstats -- this should work now.

0 Karma

matthew_foos
Path Finder

index=_internal source=license_usage.log idx=* | bin _time span=1d | stats sum(b) as bytes by idx, _time | stats avg(bytes) as bytes by idx | eval GB = round(bytes/1024/1024/1024, 4) | eval MB = round(bytes/1024/1024, 4) | table idx, GB, MB | rename idx as Index, GB as "Average GB Indexed per Day", MB as "Average MB Indexed per Day"

This ended up being my solution.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Can you share what you've tried?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...