I have been trying to get the GB used over 30 days per index, but it keeps coming back with only the first 10. I need it for all indexes, what do I need to do to get that to happen?

[nls7010]

index=_internal source=*license_usage.log type=Usage | eval GB = b/1024/1024/1024 | timechart span=30d useother=0 sum(GB) by idx | rename idx as Index, sum(GB) as GIGbyte | sort – GIGbyte
That is the search I have going, not certain why it's only bringing back the first 10 indexes only.

[kmaron · Accepted solution]

Just add limit=0 to your timechart

index=_internal source=*license_usage.log type=Usage 
| eval GB = b/1024/1024/1024 
| timechart span=30d useother=0 sum(GB) by idx limit=0
| rename idx as Index, sum(GB) as GIGbyte 
| sort – GIGbyte

[nls7010]

That worked perfectly, thank you

[Rob2520]

Try this query

index=_internal source=*license_usage.log type=Usage earliest=-30d@d latest=@d
| stats sum(b) AS Bytes by idx
| eval GB = round(Bytes/1024/1024/1024,2)
| rename idx as index
| table index GB
| sort -GB

For additional statistics on average and max license usage check my other post
https://answers.splunk.com/answers/694793/can-you-help-me-improve-this-alert-for-indexes-tha.html#an...

cheers!