Historical License Usage

[mnakhuda]

I am looking for a way to create a query that will search and store license usage data per index. The idea is that I want to be able to view this visually in a dashboard (timechart). Currently, I use the following query:

earliest=-30d@d latest=@d (index=_internal source=*license_usage.log* type="Usage")
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
| eval idx=if(((len(idx) == 0) OR isnull(idx)),"(UNKNOWN)",idx)
| timechart span=1d eval(round((sum(b)/1024/1024/1024),3)) AS Volume by idx useother=f limit=0
| addtotals row=t col=f fieldname="Daily (GB)"

From my understanding, the internal index retention is 30 days. I do not want to change this, but be able to search back past 30 days for license data similar in format to the above mentioned query. 

Any advice is appreciated, thanks!

[isoutamo]

If you don’t want to extend time to get the index usage, then you should use MC’s indexing usage dashboard and select there by index. You could open the actual query from there and modify it by yourself.
r. Ismo