HI all,
I have got a sufficient search to get license usage for the index that used by our Dev team. See below
Search -
index=_internal (idx=dev1 OR idx=dev2 OR idx=dev3) source=license_usage.log type="Usage" splunk_server= earliest=-1mon@mon@w
| eval Date=strftime(_time, "%Y/%m/%d")
| eventstats sum(b) as volume by idx, Date
| eval MB=round(volume/1024/1024,2)
| eval GB=round(volume/1024/1024/1024,2)
| timechart first(GB) AS volume by idx
However, I need it to be split by applications so 'data volume by index(dev1, dev2,dev3) by day by application name for the past month', but the applications field isnt available under_internal. I have found a search that has the information but not really sure how to merge it.
index=dev1 OR index=dev2 OR index=dev3 Properties.ApplicationName="*"
Any help would be greatful!
Thanks
