@gcasaldi , Thank you for your prompt response. For example, I want to pull the report for the entire month of May (from May 1st to May 31st, 2024) for the top 100 hosts by license usage, along with...
See more...
@gcasaldi , Thank you for your prompt response. For example, I want to pull the report for the entire month of May (from May 1st to May 31st, 2024) for the top 100 hosts by license usage, along with their index, host, source, and sourcetype. I used the following query: index=_internal source=*license_usage.log type="Usage" | eval host=lower(host) | eval MB=b/1024/1024 | eval GB=round(MB/1024,2) | search earliest=-1mo@d latest=now@d | sort - GB | head 100 | table host index source sourcetype GB ``` However, the query seems to be running continuously and does not produce any results. It is still running when I search for the previous month in the Search and Reporting app. Could you please let me know where I might have made a mistake?