Splunk Search

How to search and sum the total size of files per year?

PPape
Contributor

Hi Guys,

i wrote a script that reads the MetaData of Files in an NTFS Filesystem (like Creation Date, Last Access Date, Size etc.)

I got the output in Splunk and can do things like see how many Files where added per year. (I get this from the Creation Date)

index="fileindex" | eval cdt = strftime(strptime(CreationDate,"%d.%m.%Y %H:%M:%S"),"%Y") | stats count by cdt

But I want to know how big those files in Sum are... per Year.

So now I have an output like:
Year, Number of Files

And I want to have:
Year, Number of Files, Size of the Files

Can you please help? I have no clue how to manage this.

Thanks in advance!

Tags (4)
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi PPape,

try something like this:

index="fileindex" 
| eval cdt = strftime(strptime(CreationDate,"%d.%m.%Y %H:%M:%S"),"%Y") 
| stats sum(eval(size/1024/1024)) AS mySize_in_Mb count by cdt

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi PPape,

try something like this:

index="fileindex" 
| eval cdt = strftime(strptime(CreationDate,"%d.%m.%Y %H:%M:%S"),"%Y") 
| stats sum(eval(size/1024/1024)) AS mySize_in_Mb count by cdt

hope this helps ...

cheers, MuS

PPape
Contributor

This is exactly what i needed! Thank You very much!

0 Karma

PPape
Contributor

http://pastebin.com/U7edkq2v here is a small sample.
Yes i have a Field Size (It's the File Size in Byte)

0 Karma

MuS
SplunkTrust
SplunkTrust

Well, do you have the size of the files in your index=fileindex? If so please provide some samples....

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...