How can I get the average amount of data indexed in the last year?

Path Finder

Hi Everyone,

How can I get the average volume of data indexed by our indexer for the last year?

I am using the licensing queries but it's not giving me licensing information older than one month.

Are there any other internal logs I could refer to get this information?


Labels (1)
0 Karma

Path Finder

You can use below search and schedule it to run in every 30 days and set email alert to your email id. Then you can easily store the report and compare.:

index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d | dedup slave, date_mday | eval _time=_time - 43200 | timechart span=1d sum(b) AS volume fixedrange=false | foreach * [eval <>=round('<>'/1024/1024/1024, 3)]

0 Karma


By default, the internal logs used to produce the licensing reports are only retained for 30 days. That is why you can't get information older than one month. I see two options. The first is change the retention period for _internal, restart Splunk, and wait a year for license data to accumulate. This will use a lot of storage. The other option is to create your own monthly license report and save it in a summary index that is kept for a year. Get your annual report from the summary index.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf23 Registration is Now Open!

Time to toss the .conf-etti &#x1f389; —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...