I would like to generate a daily, weekly and monthly report for indexed volume usage by all indexes and all servers. I would like to add the usage daily , weekly and monthly as three individual columns. Is it possible to merge the results in splunk search head? I generated a report for daily indexed volume usage, but unable to add a column comparing the indexed usage weekly, monthly etc.
I'd approach this by using eventstats
. I'd create fields by using strftime
using %m for month, and %U (or %V or %W—see man pages for which you prefer) for week (number). Then, another for %j for day number. Next, I'd use eventstats to sum or count or whatever "by day_number', then "by week_number", then finally another invocation for "by month". You're required to use an "AS" clause with eventstats, so ultimately, your search might look like this:
<your search> | eval day_no=strftime(_time, "%j") | eval week_no=strftime(_time, "%U") | eval month_no=strftime(_time, "%m") | eventstats sum(kb) AS daily by day_no | eventstats sum(kb) AS weekly by week_no | eventstats sum(kb) AS monthly by month_no <display functions>
The event set would carry day_no, week_no and year_no fields along with every event, so you'd have those numbers available to pass to chart
or timechart
or stats
.
Er, sorry, I misread monthly as yearly. Edited the above to reflect that change.