Splunk Search

Stats by date

chris1
Explorer

Hi ,

I need the below splunk search to be shown in stats. Stats should be in date wise. please help.

| eventcount summarize=false report_size=true index=test| eval size_MB=size_bytes/(1024*1024) | eval size_GB=size_MB/1024

Thanks!

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The closest you can get to "space consumed by the index per day" is "space consumed by buckets of the index" and "bucket span":

| dbinspect index=main

That has startEpoch and endEpoch to give you the bucket span, and sizeOnDiskMB to give you the bucket's size. Since buckets can span weeks, how you count the per-day consumption depends on what your goals are.

martin_mueller
SplunkTrust
SplunkTrust

What do you mean by "shown in stats" and by "stats should be in date wise"?

Abilan1
Path Finder

I want to see the space consumed by the index per day.

0 Karma

ddrillic
Ultra Champion
index=_internal source="/opt/splunk/var/log/splunk/license_usage.log*"
| timechart span=1d sum(eval(round(b/1024/1024/1024,5))) by idx

seems to do it...

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...