Does anyone know a search query to find license usage by fwdType?

[kpavan]

Hi All,

Need splunk query which should tell how much license is used by forwarder type, since we are planning migrating from UF to HF.

I was able to get the fwdType details by below search, but now need to get usage by the fwdType. Please help on this.
index=_internal source=metrics.log "os=Windows" "fwdType=*" | dedup os,hostname | rename hostname as host | chart count by fwdType

Thanks!

[Raghav2384]

Forwarder sends anything you want it to. Since HF is going to be in scope for you pretty soon, i am assuming you're going to use it for filtering events? Let's say filtered data is set to send data to index=xyz.
Use |dbinspect to get the raw size on disk in MB / 1024 to get amount of raw data on MB which should be ~license usage in GB. Again, if another HF is set to send data to same index, i am not sure at that point. Click on Settings>Licensing>Usage Reports, it should give you some ideas. Not sure if there's a direct way.hope this helps.
thanks,
Raghav