Stats by date

[chris1]

Hi ,

I need the below splunk search to be shown in stats. Stats should be in date wise. please help.

| eventcount summarize=false report_size=true index=test| eval size_MB=size_bytes/(1024*1024) | eval size_GB=size_MB/1024

Thanks!

[martin_mueller]

The closest you can get to "space consumed by the index per day" is "space consumed by buckets of the index" and "bucket span":

| dbinspect index=main

That has startEpoch and endEpoch to give you the bucket span, and sizeOnDiskMB to give you the bucket's size. Since buckets can span weeks, how you count the per-day consumption depends on what your goals are.

[martin_mueller]

What do you mean by "shown in stats" and by "stats should be in date wise"?

[Abilan1]

I want to see the space consumed by the index per day.

[ddrillic]

index=_internal source="/opt/splunk/var/log/splunk/license_usage.log*"
| timechart span=1d sum(eval(round(b/1024/1024/1024,5))) by idx

seems to do it...