How to get license usage data for a particular index with a breakdown of usage by a field?

[jackiewkc]

Hi,

Does anyone know how I can query the license usage of a particular index, breakdown by a field?

Basically I have an index called testindex and there is a field in each event called log_type. I would like to know, on a given date, how much indexed data there is in this index, broken down by log_type. I would expect the output to be something like:

log_type1 10G
log_type2 1.5G
log_type3 0.45G
etc.

Any help will be greatly appreciated.

Thanks.

Regards,
Jackie

[martin_mueller · Accepted solution]

I fear the license usage logs aren't going to be helpful here, so you may need to go brute force:

index=particular | eval length = length(_raw) | timechart span=1d sum(length) by log_type

If you're going to run this more than once it'll be a good idea to summary index the daily data.

[martin_mueller]

Technically they are in characters. Convert before the timechart, so something like this:

... | eval length = length(_raw) / 1048576 | ...

to get the length in megacharacters.

[jackiewkc]

Thanks Martin

[jackiewkc]

Thanks a lot for the quick reply, I really appreciate it.

[jackiewkc]

One quick question. The numbers returned from the query you suggested, are they in bit or byte or Mb? I want to have it set to GB, but when I changed sum(length) to sum(length/1024), it didn't work.