Hello,
I am looking for help to investigate if license usage drops for perticular index day by day. Any SPL searches and other way is helpful.
Hi @kundanti!
Here's some helpful links to get you started on your journey. Once you have attempted to solve the problem, if you have a very specific issue, open a new question here.You'll need a search specific to your environment and your permissions that can access the information:https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-find-license-usage-for-a-p...Then you'll need to figure out what "normal" for your org looks like. Then you'll need to alert if below "normal".https://community.splunk.com/t5/Alerting/alert-on-license-usage/m-p/32474
Good luck!
