How can I get the average amount of data indexed in the last year?

Path Finder

Hi Everyone,

How can I get the average volume of data indexed by our indexer for the last year?

I am using the licensing queries but it's not giving me licensing information older than one month.

Are there any other internal logs I could refer to get this information?


Labels (1)
0 Karma

Path Finder

You can use below search and schedule it to run in every 30 days and set email alert to your email id. Then you can easily store the report and compare.:

index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d | dedup slave, date_mday | eval _time=_time - 43200 | timechart span=1d sum(b) AS volume fixedrange=false | foreach * [eval <>=round('<>'/1024/1024/1024, 3)]

0 Karma


By default, the internal logs used to produce the licensing reports are only retained for 30 days. That is why you can't get information older than one month. I see two options. The first is change the retention period for _internal, restart Splunk, and wait a year for license data to accumulate. This will use a lot of storage. The other option is to create your own monthly license report and save it in a summary index that is kept for a year. Get your annual report from the summary index.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...