How can I get the average amount of data indexed in the last year?

[paduka]

Hi Everyone,

How can I get the average volume of data indexed by our indexer for the last year?

I am using the licensing queries but it's not giving me licensing information older than one month.

Are there any other internal logs I could refer to get this information?

Thanks,
Paduka

[ayushchoudhary]

You can use below search and schedule it to run in every 30 days and set email alert to your email id. Then you can easily store the report and compare.:

index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d | dedup slave, date_mday | eval _time=_time - 43200 | timechart span=1d sum(b) AS volume fixedrange=false | foreach * [eval <>=round('<>'/1024/1024/1024, 3)]

[richgalloway]

By default, the internal logs used to produce the licensing reports are only retained for 30 days. That is why you can't get information older than one month. I see two options. The first is change the retention period for _internal, restart Splunk, and wait a year for license data to accumulate. This will use a lot of storage. The other option is to create your own monthly license report and save it in a summary index that is kept for a year. Get your annual report from the summary index.