Installation

Help with previous weeks index totals by day Report

plarsenDST
Explorer

I have this report for license usage for one day emailed to me daily, that shows totals by index and a daily total.

I want a report with this same format repeated/listed 5 times showing the previous weeks days Mon-Friday and I'm not sure how to accomplish it.

A manager report so they can see daily totals for the previous week emailed out on Monday AM. The email and schedule part is not the issue for me. Just the SPL learning curve.

index=_internal earliest=-1d@d latest=-0d@d source=*license_usage.log* type=Usage | bucket span=1d _time | stats sum(b) as bytes by _time idx | eval gb=round(bytes/1024/1024/1024,3) | addtotals row=false col=true | rename idx as Index | rename gb as "Total GB"
Labels (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

 index=_internal earliest=-1w@w1 latest=-1w@w5 source=*license_usage.log* type=Usage | bucket span=1d _time | stats sum(b) as bytes by _time idx | eval gb=round(bytes/1024/1024/1024,3) | appendpipe [| stats sum(gb) as gb by _time | eval idx="ZZZZZ"] | sort _time idx | rename idx as Index | rename gb as "Total GB" | eval Index=if(Index="ZZZZZ","Total For Day",Index)

View solution in original post

0 Karma

plarsenDST
Explorer

I think this will work.. I had to change latest=-1w@w5
to -0 for it to run correctly. - Thanks for the help.

 index=_internal earliest=-1w@w1 latest=-0w@w5 source=*license_usage.log* type=Usage | bucket span=1d _time | stats sum(b) as bytes by _time idx | eval gb=round(bytes/1024/1024/1024,3) | appendpipe [| stats sum(gb) as gb by _time | eval idx="ZZZZZ"] | sort _time idx | rename idx as Index | rename gb as "Total GB" | eval Index=if(Index="ZZZZZ","Total For Day",Index)
0 Karma

somesoni2
Revered Legend

Give this a try

 index=_internal earliest=-1w@w1 latest=-1w@w5 source=*license_usage.log* type=Usage | bucket span=1d _time | stats sum(b) as bytes by _time idx | eval gb=round(bytes/1024/1024/1024,3) | appendpipe [| stats sum(gb) as gb by _time | eval idx="ZZZZZ"] | sort _time idx | rename idx as Index | rename gb as "Total GB" | eval Index=if(Index="ZZZZZ","Total For Day",Index)
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...