index=_internal source="*license_usage.log" type=RolloverSummary | timechart span=1d sum(b) AS DailyVolume | eval DailyVolume=round(DailyVolume/1024/1024/1024,2) | eval License="5"
I did something similar some time ago. You can have a look at it. Probably better (faster) to use the rest command to get the information than the license usage log, as hinted in the comments.
http://answers.splunk.com/answers/39980/license-violation-prediction
Hope this helps somewhat,
K
Manager > License
Scroll down to the available and used graphic.
Deployment Manager > License Usage is also handy because it has a better graphic, but it does not show you your licensed volume - I figured it assumes you should know that already.
Thanks, but I want to write my own. There's no way to show license usage vs your allocation?