Daily license usage by index on Splunk Cloud

[sidekix24]

We just migrated over to Splunk Cloud and I'm trying to figure out how to view our daily license usage by index. I was able to do this before on the on-prem setup by going to licensing then license usage then change around the search.

With Splunk Cloud I can look up the usage in monitoring console but that shows it as a whole and when I open up the search, the index fields aren't being captured in the events.

Does anyone know how I can pull this info up?

Thanks

[mdsnmss]

Here is a base search for Splunk licensing events:

index=_internal source=*license_usage.log type="Usage"    | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)   | eval sourcetypename = st   | bin _time span=1d    | stats values(poolsz) as poolsz sum(b) as b by _time, pool, indexname, sourcetypename | eval GB=(b/1024/1024/1024)  | eval pool=(poolsz/1024/1024/1024) | fields _time, indexname, sourcetypename, GB, pool

This search will get you a list of usage across index and sourcetype for your specified timerange and is collected into 1 day buckets (since licensing goes by day). In order to get usage by index you can just add "| stats sum(GB) by indexname, _time" to the end of the search and that should give you each index's license usage for each day within your specified timerange. Unfortunately, I am not familiar with Splunk Cloud _internal events. Are these the events that aren't showing index fields within the event? If this search does not work for you, could you post a sample of the events you are seeing?