Installation

Help with previous weeks index totals by day Report

plarsenDST
Explorer

I have this report for license usage for one day emailed to me daily, that shows totals by index and a daily total.

I want a report with this same format repeated/listed 5 times showing the previous weeks days Mon-Friday and I'm not sure how to accomplish it.

A manager report so they can see daily totals for the previous week emailed out on Monday AM. The email and schedule part is not the issue for me. Just the SPL learning curve.

index=_internal earliest=-1d@d latest=-0d@d source=*license_usage.log* type=Usage | bucket span=1d _time | stats sum(b) as bytes by _time idx | eval gb=round(bytes/1024/1024/1024,3) | addtotals row=false col=true | rename idx as Index | rename gb as "Total GB"
Labels (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

 index=_internal earliest=-1w@w1 latest=-1w@w5 source=*license_usage.log* type=Usage | bucket span=1d _time | stats sum(b) as bytes by _time idx | eval gb=round(bytes/1024/1024/1024,3) | appendpipe [| stats sum(gb) as gb by _time | eval idx="ZZZZZ"] | sort _time idx | rename idx as Index | rename gb as "Total GB" | eval Index=if(Index="ZZZZZ","Total For Day",Index)

View solution in original post

0 Karma

plarsenDST
Explorer

I think this will work.. I had to change latest=-1w@w5
to -0 for it to run correctly. - Thanks for the help.

 index=_internal earliest=-1w@w1 latest=-0w@w5 source=*license_usage.log* type=Usage | bucket span=1d _time | stats sum(b) as bytes by _time idx | eval gb=round(bytes/1024/1024/1024,3) | appendpipe [| stats sum(gb) as gb by _time | eval idx="ZZZZZ"] | sort _time idx | rename idx as Index | rename gb as "Total GB" | eval Index=if(Index="ZZZZZ","Total For Day",Index)
0 Karma

somesoni2
Revered Legend

Give this a try

 index=_internal earliest=-1w@w1 latest=-1w@w5 source=*license_usage.log* type=Usage | bucket span=1d _time | stats sum(b) as bytes by _time idx | eval gb=round(bytes/1024/1024/1024,3) | appendpipe [| stats sum(gb) as gb by _time | eval idx="ZZZZZ"] | sort _time idx | rename idx as Index | rename gb as "Total GB" | eval Index=if(Index="ZZZZZ","Total For Day",Index)
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...