This seems to work on search app index=_internal source=*license_usage.log* (host=*.splunk*.* NOT (host=sh-* host=*.splunk*.*)) TERM("type=RolloverSummary")
| rex field=_raw "^(?<timestring>\d\d-\...
See more...
This seems to work on search app index=_internal source=*license_usage.log* (host=*.splunk*.* NOT (host=sh-* host=*.splunk*.*)) TERM("type=RolloverSummary")
| rex field=_raw "^(?<timestring>\d\d-\d\d-\d{4}\s\d\d:\d\d:\d\d.\d{3}\s\+\d{4})"
| eval _time=strptime(timestring,"%m-%d-%Y %H:%M:%S.%N%z")
| eval z=strftime(now(),"%z")
| eval m=substr(z,-2)
| eval h=substr(z,2,2)
| eval mzone=if(z != 0, ((h*60)+m)*(z/abs(z)), 0)
| eval min_to_utc=-1440-mzone
| eval rel_time=min_to_utc."m"
| eval _time=relative_time(_time, rel_time) + 1
| bin _time span=1d
| stats latest(b) AS b by slave, pool, _time
| timechart span=1d sum(b) AS "volume" fixedrange=false
| eval GB=round(volume/pow(2,30),3)
| append
[| search (index=_cmc_summary OR index=summary) source="splunk-entitlements"
| rex field=host "^[^.]+[.](?<stack>[^.]+)"
| search
[| rest /services/server/info splunk_server=local
| fields splunk_server
| rex field=splunk_server "^[^.]+[.](?<stack>[^.]+)"
| fields stack]
| rex field=_raw "^(?<timestring>\d\d/\d\d/\d{4}\s\d\d:\d\d:\d\d\s\+\d{4})"
| eval _time=strptime(timestring,"%m/%d/%Y %H:%M:%S %z")
| eval z=strftime(now(),"%z")
| eval m=substr(z,-2)
| eval h=substr(z,2,2)
| eval mzone=if(z != 0, ((h*60)+m)*(z/abs(z)), 0)
| eval min_to_utc=-1440-mzone
| eval rel_time=min_to_utc."m"
| eval _time=relative_time(_time, rel_time)
| bin _time span=1d
| stats max(ingest_license) as "license limit" by _time]
| stats values(*) as * by _time
| fields - volume