index=_internal source=*license_usage.log type=Usage | eval GB = b/1024/1024/1024 | timechart span=30d useother=0 sum(GB) by idx | rename idx as Index, sum(GB) as GIGbyte | sort – GIGbyte
That is the search I have going, not certain why it's only bringing back the first 10 indexes only.
Just add limit=0 to your timechart
index=_internal source=*license_usage.log type=Usage
| eval GB = b/1024/1024/1024
| timechart span=30d useother=0 sum(GB) by idx limit=0
| rename idx as Index, sum(GB) as GIGbyte
| sort – GIGbyte
Just add limit=0 to your timechart
index=_internal source=*license_usage.log type=Usage
| eval GB = b/1024/1024/1024
| timechart span=30d useother=0 sum(GB) by idx limit=0
| rename idx as Index, sum(GB) as GIGbyte
| sort – GIGbyte
That worked perfectly, thank you
Try this query
index=_internal source=*license_usage.log type=Usage earliest=-30d@d latest=@d
| stats sum(b) AS Bytes by idx
| eval GB = round(Bytes/1024/1024/1024,2)
| rename idx as index
| table index GB
| sort -GB
For additional statistics on average and max license usage check my other post
https://answers.splunk.com/answers/694793/can-you-help-me-improve-this-alert-for-indexes-tha.html#an...
cheers!