Community:Search Report: How To Create a Chart of Hourly and Accumulated Index Volume
From Splunk Wiki
How To Create a Chart of Hourly and Accumulated Index Volume
This is an example search to create a chart of Hourly Index Volume and Accumulated Daily Index Volume
You can make use of this search to create an alert when the daily index volume reach over 80% of your license or pool volume.
index=_internal group="per_index_thruput" earliest=@d latest=@h | eval mb=kb/1024 | timechart span=1h sum(mb) as HourlyTotal by series | addtotals fieldname=HourlyTotal | streamstats sum(HourlyTotal) AS AccumulatedTOTAL
Visually the chart might be confusing because the Accumulated volume might be quite larger than each index.
The keys of this search are;
1. "addtotals" to add the total of the values in the each record; HourlyTotal
2. "streamstats" to add each record's total, HourlyTotal, up record by record.
Here is the sample result and the cart;
Here is another example using 4.2 license_usage.log which is available only in the License Master.
index=_internal source="*license_usage.log*" earliest=@d | timechart span=1h sum(b) AS B by i | addtotals | streamstats sum(Total)
Lastly how can we use MB unit instead of Byte unit, and round to 2 digit floating point? Try it!