Splunk search for Daily license usage for last month
Copy
index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d | timechart span=1d sum(b) AS "License Usage" | eval "License Usage"=round("License Usage"/1024/1024/1024, 2)
This Splunk search will provide a timechart showing license usage over the past 30 day period. The results of this search are best viewed as a line chart and will serve to show you Splunk license usage over the past month.