Hi @sverdhan , you asked for a list of sourcetypes. If you want all the sourcetypes, you could try: index=_internal [ rest splunk_server=local /services/server/info
| return host] source=*lic...
See more...
Hi @sverdhan , you asked for a list of sourcetypes. If you want all the sourcetypes, you could try: index=_internal [ rest splunk_server=local /services/server/info
| return host] source=*license_usage.log* type="Usage"
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| bin _time span=1d
| stats sum(b) as b by _time, pool, s, st, h, idx
| timechart span=1d sum(b) AS volumeB by h fixedrange=false
| fields - _timediff
| foreach "*"
[ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] that's the one that you can find in the license consuming. Ciao. Giuseppe