Splunk Query for license usages

[rohitvjoshi]

Hi All,

Can you please help me with the search query to extract the license usages for last 1 yr, I am trying below search query but it is taking too long to extract the results.

Please suggest the same.

Thanks

[dkeck]

Do you have internals over one year? Default is 30 days if you did not change that you will not get your report over one year

[chrisyounger]

I can't see the query you are currently using, but I would suggest the following approach:

Run a query like this to try and determine the average size of events. Run it over a small time frame (maybe a week or so).
some_search | eval len = len(_raw) | stats avg(_len)

Then after you know roughly the average size of events you can run a query over the full time range and count how many events have occured. For example:
some_search | stats count

Multiple the result by your average event size to get a rough indication of how much license you used for that search.

You can also use tstats to really speed things up. If you post your search I can try make a tstats version for you.