https://community.splunk.com/t5/Monitoring-Splunk/Splunk-Query-for-license-usages/m-p/429155#M3631 <P>I can't see the query you are currently using, but I would suggest the following approach:</P> <P>Run a query like this to try and determine the average size of events. Run it over a small time frame (maybe a week or so).<BR /> <CODE>some_search | eval len = len(_raw) | stats avg(_len)</CODE></P> <P>Then after you know roughly the average size of events you can run a query over the full time range and count how many events have occured. For example:<BR /> <CODE>some_search | stats count</CODE><BR /><BR /> Multiple the result by your average event size to get a rough indication of how much license you used for that search.</P> <P>You can also use <CODE>tstats</CODE> to really speed things up. If you post your search I can try make a <CODE>tstats</CODE> version for you.</P> Sat, 26 Jan 2019 12:02:50 GMT chrisyounger 2019-01-26T12:02:50Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-Query-for-license-usages/m-p/429154#M3630 <P>Hi All, </P> <P>Can you please help me with the search query to extract the license usages for last 1 yr, I am trying below search query but it is taking too long to extract the results. </P> <P>Please suggest the same. </P> <P>Thanks </P> Sat, 26 Jan 2019 10:42:41 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-Query-for-license-usages/m-p/429154#M3630 rohitvjoshi 2019-01-26T10:42:41Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-Query-for-license-usages/m-p/429155#M3631 <P>I can't see the query you are currently using, but I would suggest the following approach:</P> <P>Run a query like this to try and determine the average size of events. Run it over a small time frame (maybe a week or so).<BR /> <CODE>some_search | eval len = len(_raw) | stats avg(_len)</CODE></P> <P>Then after you know roughly the average size of events you can run a query over the full time range and count how many events have occured. For example:<BR /> <CODE>some_search | stats count</CODE><BR /><BR /> Multiple the result by your average event size to get a rough indication of how much license you used for that search.</P> <P>You can also use <CODE>tstats</CODE> to really speed things up. If you post your search I can try make a <CODE>tstats</CODE> version for you.</P> Sat, 26 Jan 2019 12:02:50 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-Query-for-license-usages/m-p/429155#M3631 chrisyounger 2019-01-26T12:02:50Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-Query-for-license-usages/m-p/429156#M3632 <P>Do you have internals over one year? Default is 30 days if you did not change that you will not get your report over one year</P> Sat, 26 Jan 2019 12:06:15 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-Query-for-license-usages/m-p/429156#M3632 dkeck 2019-01-26T12:06:15Z