Looking at the Daily License Usage panel on the "Previous 30 Days" tab under Licensing, I see that the base search is:
index=_internal [set_local_host
] source=license_usage.log type="RolloverSummary" earliest=-30d@d
| eval _time=_time - 43200
| bin _time span=1d
| stats latest(b) AS b latest(stacksz) AS stacksz by slave, pool, _time
| stats sum(b) AS volumeB max(stacksz) AS stacksz by _time
| eval pctused=round(volumeB/stacksz*100,2)
| timechart span=1d max(pctused) AS "% used" fixedrange=false
What is the idea behind setting _time 1/2 day behind?
Thank you.
The rollover summary is (and can be) generated after the whole day is passed. It's just an adjustment to ensure correct rollover summary is selected for that day (summary generated today will be for yesterday).
The rollover summary is (and can be) generated after the whole day is passed. It's just an adjustment to ensure correct rollover summary is selected for that day (summary generated today will be for yesterday).