timechart of license used

[mcbradford]

I am using the following to tell me what my license usage is when I run this search.

index=_internal source=*license_usage.log earliest=@d+30m| eval GB=b/1024/1024/1024 | stats sum(GB) by pool | eval used='sum(GB)' | eval GB_Used_Today=round(used, 0) | fields GB_Used_Today

I would like to do the same, but use a timechart to show license usage per day for the past X days.

Ideas?

[yannK]

see http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume
and be aware of the difference between pre 4.2*, 4.2 and 4.3+

4.2

index=_internal source=*license_usage.log earliest=@d+30m| eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by pool

4.3

index=_internal source=*license_usage.log type=RolloverSummary |  eval GB=b/1024/1024/1024  bucket _time span=1d | stats sum(GB) by _time pool