Hi, The search I posted is meant as an example that you should adapt to your needs. The main idea is: Use a single time period instead of sub-searches. (sorry it wasn't clear as I replied to you in two different comments) For your search I'm recommending using an existing report from the Monitoring Console like "DMC License Usage Data Cube". You can activate report acceleration and instead of using "tstats" use "savedsearch" command (http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/savedsearch ). Also you could remove weekends from your results using date_wday field as search criteria if you want. Cheers, Stéphane ... View more

How much will it cost after the 6-month period is over? ... View more

Note for those that are trying to use 'trellis.name' or 'trellis.value'. It doesn't work at the moment (Splunk 7.0.2). ... View more

Thanks Stephane, Hive jdbc is working now. ... View more