What is the search that produces "/manager/system/licensing" totals for "Pools", "Indexers", "Volume used today"?

[nmclaughl1]

I'm responsible for a License Manager that hosts multiple Pool-licenses. I don't have any access to any Splunk components (search peers, search peer index clusters, search heads, etc.).

I am aware that I can manually & periodically view /manager/system/licensing on the License Manager, which appears to be the "last 24 hours" - but I want to evaluate and learn how to formulate the exact same query and get the exact same results.

I want to share the daily totals (indexed data volume by pool) to the other responsible-parties in the pool.

[pruthvikrishnap]

Hi Nm,

try this, it gives the total volume by index.
index=_internal source="license_usage.log" type=Usage | eval yearmonthday=strftime(_time, "%Y%m%d") | eval yearmonth=strftime(_time, "%Y%m%d") | stats sum(eval(b/1024/1024/1024)) AS volume_b by idx yearmonthday yearmonth | chart sum(volume_b) over yearmonth by idx

[nmclaughl1]

Thanks pruthvikrishnapolavarapu,

Your help got me closer to having an apples-to-apples indexed-volume, per day, per License Pool...

I needed:

1. more ambiguous source
2. time-range, "Per Start of Day"=psod
3. formatting to look like whatever Splunk License Manager is doing internally inside /manager/system/licensing

I adapted your example for my env and now I get totals per-pool that match my partners with licenses my-environment hosts:

earliest=-0h@d latest=now() index=_internal source="*license_usage.log" type=Usage 
| eval dmy=strftime(_time, "%m.%d.%Y") 
| stats values(dmy) AS "As of 0Hour This MonDayYr" sum(eval(b/1024/1024)) AS vol_mb_psod by pool
| eval vol_mb_psod=round(vol_mb_psod,0)
| fieldformat vol_mb_psod=tostring(vol_mb_psod,"commas")