How long does splunk retain it's daily license usage? I am running the following, with a custom date (april 1st to today), and it only goes back to April 20th.
index="_internal" source="*metrics.log" per_index_thruput | eval GB=kb/(1024*1024)| timechart span=1d sum(kb) by series
It's in the _internal
index which has a 30 day retention time.
If you want to change it you can, but keep in mind that Splunk will log a lot about itself, and it all goes into the _internal
index.
/K
or you could output it to a csv file if you just want the daily total.
Wow. 30 days? For licensing? I can't imagine anyone would want an amount that small...
You can also do a summary index and keep it that way.