Using below query now i am showing the trend of growth of one particular index for last 7 days.
index=_introspection (host=indexername) sourcetype=splunk_disk_objects component=Indexes
| rename data.* AS * | search name=assets | eval totalindexsize=total_size+datamodel_summary_size
| eval totalindexsize_GB=(totalindexsize/1024)
| fillnull value=0 totalindexsize_GB
| bin span=1d _time
| stats avg(totalindexsize_GB) AS Total_Index_Size(GB) by host,name,_time
| convert timeformat="%d-%m-%Y" ctime(_time) AS date
| rename name as IndexName
| table date, host, IndexName, Total_Index_Size(GB) | sort - Total_Index_Size(GB)
But my management wants to see growth of top 5 indexes which grew drastically.
how to achieve that. That too using the line graph
But is there any way where i can show in the same query the difference of data between each day and sort via difference so that then its very clear that which particular index grew abnormally.
Hope am clear in what i am trying to say.