Splunk License Usage: Report on max license usage per index by day and show the peak day per index

[rk60422]

I know how to pull license usage by index per day over time. That is the easy part.
Once I have that, I want to show the peak single day usage per index.

I have a summary index that captures Date, idx, GB
Example:
11/1/17, A, 1
11/2/17, A, 3
11/3/17, A, 5
11/4/17, A, 7
11/5/17, A, 9
11/1/17,B, 12
11/2/17, B, 3
11/3/17, B, 6
11/4/17, B, 8
11/5/17, B, 10
11/1/17,C, 2
11/2/17, C, 3
11/3/17, C, 16
11/4/17, C, 8
11/5/17, C, 10
11/1/17,D, 2
11/2/17, D, 3
11/3/17, D, 6
11/4/17, D, 8
11/5/17, D, 10
...
the out put I am looking for is:
11/5/17,A,9
11/1/17,B,12
11/3/17,C,16
11/5/17,D,10

[rk60422 · Accepted solution]

index=[summaryindexname]_name=License_Test
| stats sum(GB) as A by Date, idx
| eventstats max(A) as B by idx
| where A=B
| dedup A idx
| sort idx
| table Date,A idx

[rk60422]

Looks like I answered my own question...

Solution is:
index=[summaryindexname]_name=License_Test
| stats sum(GB) as A by Date, idx
| eventstats max(A) as B by idx
| where A=B
| dedup A idx
| sort idx
| table Date,A idx