https://community.splunk.com/t5/Splunk-Search/How-to-sum-up-all-the-events-in-all-the-indexers-with-a-month/m-p/587979#M204778 <P>As <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a> already pointed out, you can't aggregate data by a field that's not in your events. And a "Period" field most probably isnt't there.</P><P>Furthermore - unless you want to do a comparison of two different periods, you'd simply just pick a time range with the timepicker to contain a single day/week/month/whatever or use earliest= and latest= constraints within the search itself.</P><P>And you'd probably want to use tstats instead of stats - calculating stats over summaries is way way faster than searching from raw indexes.</P><P>You can also use either the license report directly, as&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a> said or look and calculate your stats over the index=_internal source=*/license_usage.log</P><P>There are a few options to get the stats - which one to use depends on what you need it for.</P> Tue, 08 Mar 2022 09:13:23 GMT PickleRick 2022-03-08T09:13:23Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-up-all-the-events-in-all-the-indexers-with-a-month/m-p/587916#M204749 <P>I'm trying to see if there is a report or a query I can run to sum up all the events in all the indexers with a month total? I tried this but i'm not sure if this is the right search:</P> <P>index=* | stats count by Period</P> Tue, 08 Mar 2022 05:06:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-up-all-the-events-in-all-the-indexers-with-a-month/m-p/587916#M204749 juanv 2022-03-08T05:06:13Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-up-all-the-events-in-all-the-indexers-with-a-month/m-p/587929#M204756 <P>That query probably won't work unless every event you have has a field called "Period".</P><P>The Monitoring Console should have a dashboard that provides what you're looking for.&nbsp; Look under Indexing-&gt;License Usage-&gt;History License Usage.</P> Tue, 08 Mar 2022 13:03:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-up-all-the-events-in-all-the-indexers-with-a-month/m-p/587929#M204756 richgalloway 2022-03-08T13:03:20Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-up-all-the-events-in-all-the-indexers-with-a-month/m-p/587979#M204778 <P>As <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a> already pointed out, you can't aggregate data by a field that's not in your events. And a "Period" field most probably isnt't there.</P><P>Furthermore - unless you want to do a comparison of two different periods, you'd simply just pick a time range with the timepicker to contain a single day/week/month/whatever or use earliest= and latest= constraints within the search itself.</P><P>And you'd probably want to use tstats instead of stats - calculating stats over summaries is way way faster than searching from raw indexes.</P><P>You can also use either the license report directly, as&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a> said or look and calculate your stats over the index=_internal source=*/license_usage.log</P><P>There are a few options to get the stats - which one to use depends on what you need it for.</P> Tue, 08 Mar 2022 09:13:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-up-all-the-events-in-all-the-indexers-with-a-month/m-p/587979#M204778 PickleRick 2022-03-08T09:13:23Z