All of my indexers rely on one Splunk license server. I would like a daily report that shows me for each of the last 7 days how much license was consumed for each different index name. For example:
Server1 indexes: cisco, juniper, _internal Server2 indexes: apple, metrovpn, _internal License Server indexes: smalldata, _internal
Ideally, this would be a stacked bar chart with colors for each index name and the total showing the total license consumed (in GB) for that day. So the graph would have 7 days. But I will settle for any report as long as it can give me the sum total (in GB) for each day and a breakdown by index name of the amount of license consumed per day. The _internal databases ould be summed up into a single total per day.
I played around with the searches but I can never find the detail I want, event at the License Server itself. Any help would be appreciated!
... View more