log consumption

[yuvaraj_m91]

Looking for spl query to get the index wise log consumption for each months splitup for last 6 months

[gcusello]

Hi @yuvaraj_m91 ,

you already have this search in the License Consuption Report, the problem is that usually you don't maintain six months of internal logs.

You could run a search avery day saving the results in a summary index, you you'll have a very performant search and all the data also more than the retention.

You could also run a search summing the lenght of each event of each index, but it will be very very slow search.

Ciao.

Giuseppe