How can I break a yearly total into months?

[pipegrep]

I'm using this simple search to get indexing volume by host.

index="_internal" source="*metrics.log" group="per_host_thruput" | chart sum(kb) by series | sort + series

This sorts by hostname which is what I want;

HOST     sum(kb)
hosta    1234567                     
hostb    2345678
hostc    3456789
...

...but my ultimate goal is actually to break the total down by month:

HOST   January   February   March   ...
hosta   1234567   1234567   1234567   ...                    
hostb   2345678   1234567   1234567   ...
hostc   3456789   1234567   1234567   ...
...

I've looked at timechart and span options but I feel I may be running into a more fundamental problem with my approach.

[MuS · Accepted solution]

Hi pipegrep,

how about this:

index="_internal" source="*metrics.log" group="per_host_thruput" | chart sum(kb) by series, date_month | sort + series

cheers, MuS

[yannK]

Remember that the metrics contains only the top10 of each series, so if you have more than 10 indexes or hosts, the sum will not match your actual license usage,

[Lucas_K]

How can you get it to show absolutely EVERYTHING?

If I have for example ~10,000 hosts and I put in

limits.conf (on my intermediate forwarder which passes all traffic).
[metrics]
maxseries = 100000

This should have easily covered everything, but it doesn't.

My figures for each of the different metrics groups do not match up.
http://answers.splunk.com/answers/177618/inconsistent-data-rates-reported-between-index-int.html

[MuS]

Take a look at the license_usage.log on your license master. From the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/Troubleshooting/WhatSplunklogsaboutitself

license_usage.log
Indexed volume in bytes per pool, index, source, sourcetype, and host. Starting in 4.2, license_usage.log is available only on a Splunk license master.

[pipegrep]

That was simpler than I expected, thanks. Now I need to figure out why I only get data for this month and last, but that's another issue. Thanks.
*EDIT: Looks like it's a 30 day lookup only and that's why.

[MuS]

Nope, the default retention of the index _internal is 30days. This can be changed in indexes.conf on your splunk server see the docs http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/Indexesconf

[pipegrep]