In daily license usage graph, say for 10th July, data indexed is 400GB. After that I split the daily license usage by Index. And the total of data indexed of all indexes was just 20GB .
Can anybody explain me this ?
And also , how can I calculate data indexed split by Index ?
Try this for daily license usage by index
index=_internal sourcetype=splunkd source=*license_usage.log type=usage | stats sum(b) as usage by idx | eval usage=round(usage/(1024*1024*1024),3)
Thanks ! That answers my 2nd question.
If you can help me with my 1st question as well, it would be great .