The following search executed over a seven day timeframe (referenced at https://answers.splunk.com/answers/344834/how-to-get-a-license-report-with-sourcetypes-and-i.html)...
index=_internal source=*license_usage.log type="Usage"
| eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| eval sourcetypename = st
| bin _time span=1d
| stats sum(b) as b by _time, pool, indexname, sourcetypename
| eval GB=round(b/1024/1024/1024, 3)
| fields _time, indexname, sourcetypename, GB
...provides a breakdown of total license usage by index and sourcetype per day.
I'd like to have the output of the search provide a total license usage by index and sourcetype that reflects the search timeframe used. So, for my seven day timeframe example, I'd like each entry in the Statistics tab to reflect the seven day license usage total for a single index/sourcetype pairing. Can this be done...and, if so, how?
... View more