how to get license usage in splunk by index by REST

[nithinrakesh]

how to get license usage in splunk by index by REST. I cannot find logs in index=_internal

[harsmarvania57]

Hi @nithinrakesh,

You can search splunk license usage by query index=_internal source=*license_usage.log* and do calculation based on your requirement.

If you want to use REST then you can use | rest /services/licenser/pools, this REST will give you today's license usage for different pools.

I hope this helps.

Thanks,
Harshil

[ddrillic]

This is gorgeous - | rest /services/licenser/pools. But how can we break it by index?

I have a similar thing when doing it from the UI at - Why do we see a discrepancy between the daily licensing page and the Usage report for the past 30 da...

[nithinrakesh]

HI @Harshil I got it through pools but I need group by index