I am using the following to tell me what my license usage is when I run this search.
index=_internal source=*license_usage.log earliest=@d+30m| eval GB=b/1024/1024/1024 | stats sum(GB) by pool | eval used='sum(GB)' | eval GB_Used_Today=round(used, 0) | fields GB_Used_Today
I would like to do the same, but use a timechart to show license usage per day for the past X days.
Ideas?
see http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume
and be aware of the difference between pre 4.2*, 4.2 and 4.3+
4.2
index=_internal source=*license_usage.log earliest=@d+30m| eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by pool
4.3
index=_internal source=*license_usage.log type=RolloverSummary | eval GB=b/1024/1024/1024 bucket _time span=1d | stats sum(GB) by _time pool