https://community.splunk.com/t5/Splunk-Enterprise/%E9%81%8E%E5%8E%BB1%E5%B9%B4%E3%81%94%E3%81%A8%E3%81%AE%E7%B7%8F%E3%83%AD%E3%82%B0%E9%87%8F%E3%81%AE%E6%8E%A8%E7%A7%BB%E3%82%B0%E3%83%A9%E3%83%95/m-p/519410#M3410 <P>(index=_telemetry source=*license_usage_summary.log* type="RolloverSummary")<BR />| bin _time span=1d<BR />| stats latest(b) AS b by slave, pool, _time<BR />| timechart span=1d sum(b) AS "volume" fixedrange=true<BR />| eval GB=round((((volume / 1024) / 1024) / 1024),3), Volume=GB<BR />| fields - GB, volume</P> Mon, 14 Sep 2020 12:05:32 GMT thambisetty 2020-09-14T12:05:32Z https://community.splunk.com/t5/Splunk-Enterprise/%E9%81%8E%E5%8E%BB1%E5%B9%B4%E3%81%94%E3%81%A8%E3%81%AE%E7%B7%8F%E3%83%AD%E3%82%B0%E9%87%8F%E3%81%AE%E6%8E%A8%E7%A7%BB%E3%82%B0%E3%83%A9%E3%83%95/m-p/519328#M3408 <P>SplunkEnterpriseを利用しています。</P><P>過去1年の日ごとの総ログ量の推移を確認したいのですが、</P><P>_internalインデックスには過去30日までしかログを保管されておりません。</P><P>過去30日より以前のログに関してはどのインデックスを指定すれば確認できるでしょうか。</P> Mon, 14 Sep 2020 02:20:57 GMT https://community.splunk.com/t5/Splunk-Enterprise/%E9%81%8E%E5%8E%BB1%E5%B9%B4%E3%81%94%E3%81%A8%E3%81%AE%E7%B7%8F%E3%83%AD%E3%82%B0%E9%87%8F%E3%81%AE%E6%8E%A8%E7%A7%BB%E3%82%B0%E3%83%A9%E3%83%95/m-p/519328#M3408 ishidak 2020-09-14T02:20:57Z https://community.splunk.com/t5/Splunk-Enterprise/%E9%81%8E%E5%8E%BB1%E5%B9%B4%E3%81%94%E3%81%A8%E3%81%AE%E7%B7%8F%E3%83%AD%E3%82%B0%E9%87%8F%E3%81%AE%E6%8E%A8%E7%A7%BB%E3%82%B0%E3%83%A9%E3%83%95/m-p/519410#M3410 <P>(index=_telemetry source=*license_usage_summary.log* type="RolloverSummary")<BR />| bin _time span=1d<BR />| stats latest(b) AS b by slave, pool, _time<BR />| timechart span=1d sum(b) AS "volume" fixedrange=true<BR />| eval GB=round((((volume / 1024) / 1024) / 1024),3), Volume=GB<BR />| fields - GB, volume</P> Mon, 14 Sep 2020 12:05:32 GMT https://community.splunk.com/t5/Splunk-Enterprise/%E9%81%8E%E5%8E%BB1%E5%B9%B4%E3%81%94%E3%81%A8%E3%81%AE%E7%B7%8F%E3%83%AD%E3%82%B0%E9%87%8F%E3%81%AE%E6%8E%A8%E7%A7%BB%E3%82%B0%E3%83%A9%E3%83%95/m-p/519410#M3410 thambisetty 2020-09-14T12:05:32Z https://community.splunk.com/t5/Splunk-Enterprise/%E9%81%8E%E5%8E%BB1%E5%B9%B4%E3%81%94%E3%81%A8%E3%81%AE%E7%B7%8F%E3%83%AD%E3%82%B0%E9%87%8F%E3%81%AE%E6%8E%A8%E7%A7%BB%E3%82%B0%E3%83%A9%E3%83%95/m-p/520069#M3460 <P>Thank you so much.</P><P>The log has been successfully displayed.</P><P>I am gratefui for your advice.</P><P>&nbsp;</P> Thu, 17 Sep 2020 08:08:30 GMT https://community.splunk.com/t5/Splunk-Enterprise/%E9%81%8E%E5%8E%BB1%E5%B9%B4%E3%81%94%E3%81%A8%E3%81%AE%E7%B7%8F%E3%83%AD%E3%82%B0%E9%87%8F%E3%81%AE%E6%8E%A8%E7%A7%BB%E3%82%B0%E3%83%A9%E3%83%95/m-p/520069#M3460 ishidak 2020-09-17T08:08:30Z https://community.splunk.com/t5/Splunk-Enterprise/%E9%81%8E%E5%8E%BB1%E5%B9%B4%E3%81%94%E3%81%A8%E3%81%AE%E7%B7%8F%E3%83%AD%E3%82%B0%E9%87%8F%E3%81%AE%E6%8E%A8%E7%A7%BB%E3%82%B0%E3%83%A9%E3%83%95/m-p/520121#M3469 <P>you are welcome. please accept my answer as solution.</P> Thu, 17 Sep 2020 12:12:39 GMT https://community.splunk.com/t5/Splunk-Enterprise/%E9%81%8E%E5%8E%BB1%E5%B9%B4%E3%81%94%E3%81%A8%E3%81%AE%E7%B7%8F%E3%83%AD%E3%82%B0%E9%87%8F%E3%81%AE%E6%8E%A8%E7%A7%BB%E3%82%B0%E3%83%A9%E3%83%95/m-p/520121#M3469 thambisetty 2020-09-17T12:12:39Z