Splunk Search for License Usage by Sourcetype Copy
index=_internal source=*license_usage.log type="Usage" | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) ```| search st=<insert sourcetype here>``` | timechart span=1d sum(eval(b/pow(1024,3))) by st
0 comments