Can i please know the query to find the license consumption for an index for each day for last 30 days . For example, i have an index called "webserver_index" , i would like to know the each day license consumption of this index for lat 30 days.
Try this!
index=_internal source=license_usage.log type=Usage
| eval gb=b/1024/1024/1024
| timechart span=1d sum(gb) AS index_volume_GB by idx
Try this!
index=_internal source=license_usage.log type=Usage
| eval gb=b/1024/1024/1024
| timechart span=1d sum(gb) AS index_volume_GB by idx