How to sum up all the events in all the indexers with a month total?

[juanv]

I'm trying to see if there is a report or a query I can run to sum up all the events in all the indexers with a month total? I tried this but i'm not sure if this is the right search:

index=* | stats count by Period

[PickleRick]

As @richgalloway already pointed out, you can't aggregate data by a field that's not in your events. And a "Period" field most probably isnt't there.

Furthermore - unless you want to do a comparison of two different periods, you'd simply just pick a time range with the timepicker to contain a single day/week/month/whatever or use earliest= and latest= constraints within the search itself.

And you'd probably want to use tstats instead of stats - calculating stats over summaries is way way faster than searching from raw indexes.

You can also use either the license report directly, as @richgalloway said or look and calculate your stats over the index=_internal source=*/license_usage.log

There are a few options to get the stats - which one to use depends on what you need it for.

[richgalloway · Accepted solution]

That query probably won't work unless every event you have has a field called "Period".

The Monitoring Console should have a dashboard that provides what you're looking for.  Look under Indexing->License Usage->History License Usage.