Installation

How can I get the average amount of data indexed in the last year?

Path Finder

Hi Everyone,

How can I get the average volume of data indexed by our indexer for the last year?

I am using the licensing queries but it's not giving me licensing information older than one month.

Are there any other internal logs I could refer to get this information?

Thanks,
Paduka

Labels (1)
0 Karma

Path Finder

You can use below search and schedule it to run in every 30 days and set email alert to your email id. Then you can easily store the report and compare.:

index=internal source=*licenseusage.log type="RolloverSummary" earliest=-30d@d | dedup slave, datemday | eval _time=time - 43200 | timechart span=1d sum(b) AS volume fixedrange=false | foreach * [eval <>=round('<>'/1024/1024/1024, 3)]

0 Karma

SplunkTrust
SplunkTrust

By default, the internal logs used to produce the licensing reports are only retained for 30 days. That is why you can't get information older than one month. I see two options. The first is change the retention period for _internal, restart Splunk, and wait a year for license data to accumulate. This will use a lot of storage. The other option is to create your own monthly license report and save it in a summary index that is kept for a year. Get your annual report from the summary index.

---
If this reply helps you, an upvote would be appreciated.
0 Karma