I need to build a monthly report that shows average daily usage for charge-back purposes. I have sorted out how to give them everything they are asking for except for the data retention. They want me to include a column in the report that shows what indexes are 30, 93, 180 or 365 days of retention.
How would I go about adding that information?
This is my search so far:
earliest=-30d@d latest=@d index=internal source=license_usage.log type=Usage idx="" |
eval date=strftime(_time, "%Y%m%d") |
stats sum(b) as sum by idx, date |
eval GB = sum/1024/1024/1024 |
chart avg(GB) as "Average Daily - GB", max(GB) as "Monthly Peak - GB" by idx |
rex field=idx "^.?(?\d+)_(?\d+)$"