How do I query ingestion in GB by each index instead of just the top 10?

[ney]

Hi, how do I query ingestion in GB by each index instead of just the top 10?

[PickleRick]

I assume you're referring to the report from the licensing report. You can click on the small magnifying glass below the chart to open the search in a new search window. There you can add "limit=0 useother=f" to the timechart command and you're good to go 🙂

[Roy_9]

@ney Hello,

Try the below search.

index=_internal idx=* component=LicenseUsage earliest=-30d@d latest=@d
| eval
GB=round('b'/pow(1024, 3), 3)
| stats
sum(GB) as total_daily_GB
by idx

Note: you can set the earliest and latest as per your desired time

Thanks