How to search and develop a chart for license usage by index over 2 days with column displaying the percent change?

[brywilk_umich]

Hi All,

Does anyone have a search/report that shows all of your indexes with usage by day vs the previous day with a column for percent change?

[somesoni2 · Accepted solution]

Give this a try (run from license master node. You can run from any Search Head if you're forwarding your license master logs to Indexers). License usage shown in GB. Compares today vs yesterday.

index=_internal sourcetype=splunkd source=*license_usage.log type=usage earliest=-1d@d 
| eval day=if(_time>relative_time(now(),"@d"),"today","yesterday") | chart sum(b) as usage by idx day
| eval today=round(today/1024/1024/1024,3) | eval yesterday=round(yesterday/1024/1024/1024,3)
| eval percent_change=round((today-yesterday)*100/yesterday,2)

[brywilk_umich]

Perfect! Thanks!