The license usage logs identify your indexers by their guid, stored in the "i" field, so you will need to translate this into a hostname. The easiest way to do this is by hitting the "licenser/slave" endpoint on your license master and exporting the data to be used as a lookup table on the instance you're searching your license data. The example below assumes you are logged into the GUI on your license master and using the rest search command.
| rest /services/licenser/slaves splunk_server=local | fields title label | rename title AS guid, label AS indexer
This will generate a table to map guid to server name. Export this data using the export function or output it to a csv using loutputlookup or outputcsv commands. The end goal is to move it to your search instance as a lookup table, which will be used to enrich your license usage data. Once it is there, a search to determine the usage by indexer will be trivial.
You can use the predict command for forecasting.
earliest=-30d@d latest=-0d@d index=_internal sourcetype=splunkd source="/opt/splunk/var/log/splunk/license_usage.log" type=Usage | fields b | timechart span=1d sum(b) AS b | predict b future_timespan=365
I am no expert on the predict command, so I suggest reading the documentation for tuning purposes.
http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Predict
... View more
