index growth in last 7 days

[surekhasplunk]

Hi,

Using below query now i am showing the trend of growth of one particular index for last 7 days.
index=_introspection (host=indexername) sourcetype=splunk_disk_objects component=Indexes
| rename data.* AS * | search name=assets | eval totalindexsize=total_size+datamodel_summary_size
| eval totalindexsize_GB=(totalindexsize/1024)
| fillnull value=0 totalindexsize_GB
| bin span=1d _time
| stats avg(totalindexsize_GB) AS Total_Index_Size(GB) by host,name,_time
| convert timeformat="%d-%m-%Y" ctime(_time) AS date
| rename name as IndexName
| table date, host, IndexName, Total_Index_Size(GB) | sort - Total_Index_Size(GB)

But my management wants to see growth of top 5 indexes which grew drastically.
how to achieve that. That too using the line graph

Thanks

[gcusello · Accepted solution]

Hi @surekhasplunk,
did you explored the dashboards in Monitoring Console?
Anyway, try something like this:

index=_introspection sourcetype=splunk_disk_objects component=Indexes [ search 
     index=_introspection sourcetype=splunk_disk_objects component=Indexes 
     | stats avg(data.total_size) AS data.total_size BY data.name
     | sort - data.total_size
     | head 5
     | fields data.name ] 
| timechart span=1d avg(data.total_size) AS Total_Index_Size(GB) by data.name

Ciao.
Giuseppe

[surekhasplunk]

Thanks for this @gcusello,

But is there any way where i can show in the same query the difference of data between each day and sort via difference so that then its very clear that which particular index grew abnormally.
Hope am clear in what i am trying to say.

Thanks