I'm responsible for a License Manager that hosts multiple Pool-licenses. I don't have any access to any Splunk components (search peers, search peer index clusters, search heads, etc.).
I am aware that I can manually & periodically view /manager/system/licensing on the License Manager, which appears to be the "last 24 hours" - but I want to evaluate and learn how to formulate the exact same query and get the exact same results.
I want to share the daily totals (indexed data volume by pool) to the other responsible-parties in the pool.
try this, it gives the total volume by index.
index=_internal source="license_usage.log" type=Usage | eval yearmonthday=strftime(_time, "%Y%m%d") | eval yearmonth=strftime(_time, "%Y%m%d") | stats sum(eval(b/1024/1024/1024)) AS volume_b by idx yearmonthday yearmonth | chart sum(volume_b) over yearmonth by idx
Your help got me closer to having an apples-to-apples indexed-volume, per day, per License Pool...
more ambiguous source
time-range, "Per Start of Day"=psod
formatting to look like whatever Splunk License Manager is doing internally inside /manager/system/licensing
I adapted your example for my env and now I get totals per-pool that match my partners with licenses my-environment hosts:
earliest=-0h@d latest=now() index=_internal source="*license_usage.log" type=Usage
| eval dmy=strftime(_time, "%m.%d.%Y")
| stats values(dmy) AS "As of 0Hour This MonDayYr" sum(eval(b/1024/1024)) AS vol_mb_psod by pool
| eval vol_mb_psod=round(vol_mb_psod,0)
| fieldformat vol_mb_psod=tostring(vol_mb_psod,"commas")