Hi All,
Can you please help me with the search query to extract the license usages for last 1 yr, I am trying below search query but it is taking too long to extract the results.
Please suggest the same.
Thanks
Do you have internals over one year? Default is 30 days if you did not change that you will not get your report over one year
I can't see the query you are currently using, but I would suggest the following approach:
Run a query like this to try and determine the average size of events. Run it over a small time frame (maybe a week or so).
some_search | eval len = len(_raw) | stats avg(_len)
Then after you know roughly the average size of events you can run a query over the full time range and count how many events have occured. For example:
some_search | stats count
Multiple the result by your average event size to get a rough indication of how much license you used for that search.
You can also use tstats
to really speed things up. If you post your search I can try make a tstats
version for you.