Volume end of each day

[EH]

Hi community, using Splunk for a ~month now and need some help,

If done correctly, I have the realtime volume/depot. Now I need the volume/depot at the end of each day last month. I'm stuck here, hope anyone can help me out.

index=BLA
| eventstats latest(status) as END_status by order_id
| search END_status IN
(
"Product Arrived at Final Depot"
"Processing Order at Depot"
"Ready for Transit to Final Depot"
"Processing Order for Client Delivery"
"Product Ready for Client Delivery"
"Ready for Transit to Nearest Depot"
)
| where status=END_status
| lookup products.csv product_id OUTPUT length, width, depth
| eval "volume"=round(length*width*depth/1000000,2)
| stats sum(volume) as "volume in m3" by depot_id

[ITWhisperer · Accepted solution]

Change this

| stats sum(volume) as "volume in m3" by depot_id

to

| bin span=1d _tme
| stats sum(volume) as "volume in m3" by depot_id, _time

[EH]

With this tho, I would still search on just that day. I need to take the last month in account as well.

[ITWhisperer]

Set the query time to cover the last month, or whatever time period you want the daily volumes from