Hi,
Is there a way to determine Splunk License Usage for a specific event type.
I used index=_internal source=*license_usage.log* st=abcd to determine the license usage for the entire sourcetype.
To dig in deeper for the specific event type I found articles pointing to use len(_raw) which gives the byte size length of the raw event. I used the below to check if it returns the same from license_usage.log
index="x" sourcetype=abcd | bin _time span=1d | eval size=len(_raw) | stats sum(size) as sizeInBytes by _time | eval GB = sizeInBytes/1024/1024/1024
The numbers do not match. The numbers from len(_raw) are very high when compared to the actual License Usage.
