After updating a new license key, why is the indexing volume used not showing the correct result?

[seema2502]

Hi Team,

i have changed my license key from 40GB to 65GB, but this search:

index = __internal metrics kb group="per_index_thruput" series!=_* | eval totalGB = (kb / 1024) / 1024 | timechart span=1d sum(totalGB) as total 

is still referring to 40GB and giving the wrong result.

can you please tell me what do i need to change to get the correct volume usage for 65GB?

Thanks,
Seema

[masonmorales]

Take a look at the SUM App: https://splunkbase.splunk.com/app/2678/