License usage for last 30 days by day per hour

[splunk_kk]

Hello everyone,

I'm creating a search to calculate the license usage in last 30 days by day per hour. What table I want is attached as a picture

The search I tried is the one mentioned below. but I'm definitely missing the points here.

earliest-@d-30d latest=@d-1s index=_internal source=license_usage.log type=Usage | timechart span=1h sum(b) as bytes by date_mday | eval MB=round(byte/1024/1024,2) | fields _time date_mday MB

Thanks in advance

[niketn]

@splunk_kk, try the following based on Splunk's Licence Monitoring Query

index=_internal 
    [ `set_local_host`] source=*license_usage.log* type="RolloverSummary" earliest=-30d@d 
| bin _time span=1h 
| stats latest(b) AS b by slave, pool, _time 
| eval Date="Date:".strftime(_time,"%Y/%m/%d") 
| eval Time=strftime(_time,"%H").":00" 
| chart sum(b) AS "volume" by Time Date fixedrange=false limit=31 useother=f
| fields - _timediff 
| foreach "Date:*" 
    [ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] 
| rename "Date:*" as "*"

PS: The macro set_local_host is defined in Search App hence in order to use this outside of Search App you would need to use the underlying query instead or make the macro global.... ie. use the following instead of [set_local_host]

[rest splunk_server=local /services/server/info | return host]