Splunk Search

How would I get these results by day

rmcdougal
Path Finder

I am attempting to write a license usage search and I would like to be able to see the usage for the last 7 days. Here is what I am using so far and it shows the usage just fine all added together. I would like it to be broken down by day, any ideas?

index=_internal source=license_usage pool="auto_generated_pool_enterprise" | eval GB=b/1024/1024/1024 | stats sum(GB) by pool

Tags (1)
0 Karma

sideview
SplunkTrust
SplunkTrust

If you want to
a) end up with the data in graph form with both pool and day-of-week values, then you want to look at the chart command.

index=_internal source=license_usage pool="auto_generated_pool_enterprise" | eval GB=b/1024/1024/1024 | chart sum(GB) over date_wday by pool

b) if you dont want to graph it and you want to end up with more of a flat table where each row is a unique combination of a pool value and a day-of-week value, then you would use stats this way:

index=_internal source=license_usage pool="auto_generated_pool_enterprise" | eval GB=b/1024/1024/1024 | stats sum(GB) by date_wday pool

hth

Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...