Hi community, using Splunk for a ~month now and need some help, If done correctly, I have the realtime volume/depot. Now I need the volume/depot at the end of each day last month. I'm stuck here, hope anyone can help me out. index=BLA | eventstats latest(status) as END_status by order_id | search END_status IN ( "Product Arrived at Final Depot" "Processing Order at Depot" "Ready for Transit to Final Depot" "Processing Order for Client Delivery" "Product Ready for Client Delivery" "Ready for Transit to Nearest Depot" ) | where status=END_status | lookup products.csv product_id OUTPUT length, width, depth | eval "volume"=round(length*width*depth/1000000,2) | stats sum(volume) as "volume in m3" by depot_id
... View more