how long does splunk retain daily license data

[a212830]

How long does splunk retain it's daily license usage? I am running the following, with a custom date (april 1st to today), and it only goes back to April 20th.

index="_internal" source="*metrics.log" per_index_thruput | eval GB=kb/(1024*1024)| timechart span=1d sum(kb) by series

[kristian_kolb]

It's in the _internal index which has a 30 day retention time.

If you want to change it you can, but keep in mind that Splunk will log a lot about itself, and it all goes into the _internal index.

/K

[kristian_kolb]

or you could output it to a csv file if you just want the daily total.

[a212830]

Wow. 30 days? For licensing? I can't imagine anyone would want an amount that small...

[alacercogitatus]

You can also do a summary index and keep it that way.