topic Re: How to generate a search to obtain a report on licensed users and their Total and Average license usage over a 60 day period? in Security

How to generate a search to obtain a report on licensed users and their Total and Average license usage over a 60 day period?

splgeek — Wed, 19 Oct 2016 14:22:20 GMT

How can I generate a SPL search to get data on Splunk licensed users along with their license usage (Total and Average) over a 60 days period?

I have searched Answers and I couldn't find what I was looking for.

Re: How to generate a search to obtain a report on licensed users and their Total and Average license usage over a 60 day period?

skoelpin — Wed, 19 Oct 2016 14:27:19 GMT

Go to Settings>Licensing >Usage report > Previous 30 days > Open in search > Time range picker for past 60 days

Or do this

index=_internal source=*license_usage.log type="RolloverSummary" earliest=-60d@d   | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | timechart span=1d sum(b) AS "volume" fixedrange=false | join type=outer _time [search index=_internal source=*license_usage.log type="RolloverSummary" earliest=-60d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(stacksz) AS "stack size" by _time] | fields - _timediff  | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]

Re: How to generate a search to obtain a report on licensed users and their Total and Average license usage over a 60 day period?

splgeek — Wed, 19 Oct 2016 14:34:08 GMT

Thanks
I got Time , Volume in GB and Stacksize, i dont need stack size

Also how can i further drill down to License usage by users , total and average

I dont have direct access to License master
so i cant use Settings,License Master

Re: How to generate a search to obtain a report on licensed users and their Total and Average license usage over a 60 day period?

skoelpin — Wed, 19 Oct 2016 14:39:42 GMT

Since Splunks licensing model is based off data indexed and not tied to users, this is not possible. A user cannot consume licenses, the only thing that can consume licenses is by adding more data into Splunk. By average licenses used, can you give me an example of what your looking for? Do you want average license amount consumed per month? Why get averages when you have the total amount per day?

Re: How to generate a search to obtain a report on licensed users and their Total and Average license usage over a 60 day period?

splgeek — Wed, 19 Oct 2016 14:48:50 GMT

Sorry got mixed up

Total License Usage over 60 days
based off splunk servers, - extracted field splunk_server

Re: How to generate a search to obtain a report on licensed users and their Total and Average license usage over a 60 day period?

skoelpin — Wed, 19 Oct 2016 15:09:24 GMT

I'm still not clear about what you're looking for

Here's a query which will find the average of 60 days worth of data

index=_internal source=*license_usage.log type="RolloverSummary" earliest=-60d@d pool="rtg_pool" | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | timechart span=1d sum(b) AS "volume" fixedrange=false | join type=outer _time [search index=_internal source=*license_usage.log type="RolloverSummary" earliest=-60d@d pool="rtg_pool" | eval _time=_time - 43200 | bin _time span=1d | stats latest(poolsz) AS  "pool size" by _time] | fields - _timediff  | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] | stats avg(volume)

Re: How to generate a search to obtain a report on licensed users and their Total and Average license usage over a 60 day period?

splgeek — Wed, 19 Oct 2016 15:13:27 GMT

sorry about the confusion-
some how i am still seeing only last 30 days worth of data only.

Also I want to add to this search the

Re: How to generate a search to obtain a report on licensed users and their Total and Average license usage over a 60 day period?

skoelpin — Wed, 19 Oct 2016 15:34:53 GMT

Add what to the search?

Re: How to generate a search to obtain a report on licensed users and their Total and Average license usage over a 60 day period?

splgeek — Wed, 19 Oct 2016 15:37:56 GMT

add Host info to the search aswell

Re: How to generate a search to obtain a report on licensed users and their Total and Average license usage over a 60 day period?

skoelpin — Wed, 19 Oct 2016 15:40:36 GMT

Here's licenses usage by host

index=_internal source=*license_usage.log type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st, h, idx  | search pool="rtg_pool" | timechart span=1d sum(b) AS volumeB by h fixedrange=false  | join type=outer _time [search index=_internal source=*license_usage.log type="RolloverSummary" earliest=-60d@d  | search pool="rtg_pool" | eval _time=_time - 43200 | bin _time span=1d | stats latest(poolsz) AS  "pool size" by _time] | fields - _timediff  | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]

Re: How to generate a search to obtain a report on licensed users and their Total and Average license usage over a 60 day period?

splgeek — Wed, 19 Oct 2016 20:20:51 GMT

thank you for your time and effort

Re: How to generate a search to obtain a report on licensed users and their Total and Average license usage over a 60 da

TrangCIC81 — Thu, 07 Sep 2023 01:26:25 GMT

Hi,

I have the same problem here. Tried to set it to 60 days but it only shows 30 day data by using your spl.