Hi, how do I query ingestion in GB by each index instead of just the top 10?
I assume you're referring to the report from the licensing report. You can click on the small magnifying glass below the chart to open the search in a new search window. There you can add "limit=0 useother=f" to the timechart command and you're good to go 🙂
@ney Hello,
Try the below search.
index=_internal idx=* component=LicenseUsage earliest=-30d@d latest=@d
| eval
GB=round('b'/pow(1024, 3), 3)
| stats
sum(GB) as total_daily_GB
by idx
Note: you can set the earliest and latest as per your desired time
Thanks