Splunk Ingestion by Day

[scout29]

I am trying to create a bar chart that shows the total daily splunk ingestion (in TB) by day for the past month. I am using the below search, but i am not able to get the |timechart to work to display the total ingestion by day. What am i missing?

index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" type=Usage idx=* | stats sum(b) as usage
| eval usage=round(usage/1024/1024/1024) | eval usage = tostring(Used, "commas")

[scelikok]

There is a typo on @richgalloway's suggestion, please try below;

index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" type=Usage idx=* 
| timechart span=1d sum(b) as usage
| eval usage=round(usage/1024/1024/1024) 
| eval usage = tostring(usage, "commas")

[richgalloway]

Replace stats in the query with timechart and it should work.

index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" type=Usage idx=* 
| timechart span=1d sum(b) as usage
| eval usage=round(usage/1024/1024/1024) 
| eval usage = tostring(Used, "commas")

[PickleRick]

You're doing stats aggregation to a single value. Your stats sum(b) will produce just one overall number.

[gcusello]

Hi @scout29 ,

see in the Monitoring Console App or in [Settins > License < License Conuption Report > previous 30 days] and you'll have your search.

ciao.

Giuseppe