HI all i have prepared splunk search query for every day poolwise license but i need last 6 months poolwise data and it is for every day from last 6 months onwords
query for daily license check for poolwise
|rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval quota=if(isnull(effective_quota),quota,effective_quota) | eval Used=round(used_bytes/1024/1024/1024, 3) | eval Quota=round(quota/1024/1024/1024, 3)| fields Pool Used Quota| eval PercentageUsed=Used*100/Quota|fields Pool Used Quota PercentageUsed|eval PercentageUsed = PercentageUsed + " %"
Result:
Pool Used Quota PercentageUsed
| auto_generated_pool_enterprise | 0.000 | 0.211 | 0.00 % |
| Development | 15.684 | 29.297 | 53.534 % |
| Linux Operations | 1.586 | 8.789 | 18.05 % |
| Networks Logs | 0.801 | 2.441 | 32.8 % |
| Production | 41.616 | 94.238 | 44.161 % |
This query is for daily basis and it will provide the day wise license
can you please help me with the query for last 6 months everyday how much license is consumed
