If I want to gather the statistics day by day for seeing the trend of each type of data and for checking the usage of any new data on-board in the future.

[ctksplunkctk]

Hi all,
I have search through the questions asked regarding caption question and find below query. If I want to gather the statistics day by day for seeing the trend of each type of data and for checking the usage of any new data on-board in the future.
How should I modify the query?
Thanks for the help in advance.
Ricky

1. index=_internal source=*license_usage.log type="Usage"
2. | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
3. | eval sourcetypename = st
4. | bin _time span=1d
5. | stats sum(b) as b by _time, pool, indexname, sourcetypename
6. | eval GB=round(b/1024/1024/1024, 3)
7. | fields _time, indexname, sourcetypename, GB

[to4kawa · Accepted solution]

index=_internal source=*license_usage.log type="Usage" 
| eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
| eval sourcetypename = st 
| bin _time span=1d 
| stats sum(b) as b by _time, pool, indexname, sourcetypename 
| eval GB=round(b/1024/1024/1024, 3) 
| fields _time, indexname, sourcetypename, GB
| eval index_sourcetype=indexname.":".sourcetypename
| xyseries _time index_sourcetype GB
| fillnull value=0.000

Hi, @ctksplunkctk
How about this?

[ctksplunkctk]

thanks @to4kawa, its work !