How can I get the average amount of data indexed in the last year?

Path Finder

Hi Everyone,

How can I get the average volume of data indexed by our indexer for the last year?

I am using the licensing queries but it's not giving me licensing information older than one month.

Are there any other internal logs I could refer to get this information?


Labels (1)
0 Karma

Path Finder

You can use below search and schedule it to run in every 30 days and set email alert to your email id. Then you can easily store the report and compare.:

index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d | dedup slave, date_mday | eval _time=_time - 43200 | timechart span=1d sum(b) AS volume fixedrange=false | foreach * [eval <>=round('<>'/1024/1024/1024, 3)]

0 Karma


By default, the internal logs used to produce the licensing reports are only retained for 30 days. That is why you can't get information older than one month. I see two options. The first is change the retention period for _internal, restart Splunk, and wait a year for license data to accumulate. This will use a lot of storage. The other option is to create your own monthly license report and save it in a summary index that is kept for a year. Get your annual report from the summary index.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...