Please advise on Licensing: Workload/Usage based Vs. Daily ingest which is better & why ? Thank u a million

SamHTexas — Tue, 09 Nov 2021 22:35:06 GMT

Which is beneficial ? Workload / Usage based licensing vs. daily ingest? Any useful SPLs would help a lot. Thax very much in advance.

Re: Please advise on Licensing: Workload/Usage based Vs. Daily ingest which is better & why ? Thank u a million

richgalloway — Wed, 10 Nov 2021 00:56:43 GMT

We don't have nearly enough information about how you use Splunk to answer that question. Contact your account team. They will mutter some incantations and come up with an answer for you. There is no SPL you can run that give you the answer.

Re: Please advise on Licensing: Workload/Usage based Vs. Daily ingest which is better & why ? Thank u a million

SamHTexas — Wed, 10 Nov 2021 16:27:11 GMT

I appreciate your reply & might be asking too much. I have used the following in the past in my new environment it returns an error, "in the search expression you must provide a macro expression" that I can not fix, I did try ! When free please advise & Thx again

index=_introspection earliest=-30d component=Hostwide

[|inputlookup dmc_assets

| table serverName as host, search_group

| search search_group=*dmc_group_index* OR search_group=*dmc_group_search_head*

| table host ]

| eval cpu_util = ('data.cpu_user_pct' + 'data.cpu_system_pct')

| bin _time span=5m

| table _time host data.cpu_count data.virtual_cpu_count data.cpu_idle_pct data.cpu_idle_pct cpu_util

```5-min Roll-Up```

| stats max(data.cpu_count) AS physical_cores, max(data.virtual_cpu_count) AS numberOfVirtualCores,

max(cpu_util) as CPU_util_pct_max

by _time host

| eval max_5minCPUsUsed = CPU_util_pct_max*numberOfVirtualCores/100

| stats values(host) as host_list dc(host) as total_hosts sum(physical_cores) as physical_cores sum(numberOfVirtualCores) as numberOfVirtualCores

sum(max_5minCPUsUsed) as max_5minCPUsUsed

by _time

```24h Roll-Up```

| bin _time span=1d

| stats values(host_list) as host_list max(total_hosts) as total_hosts max(physical_cores) as physical_cores max(numberOfVirtualCores) as numberOfVirtualCores

p90(max_5minCPUsUsed) as p90Daily_5minMax_CPUsUsed

by _time

```Month Roll-Up```

| appendpipe [

| stats max(total_hosts) as total_hosts, max(physical_cores) as physical_cores, max(numberOfVirtualCores) as numberOfVirtualCores,

p90(p90Daily_5minMax_CPUsUsed) as p90Daily_5minMax_CPUsUsed

| eval _time="90th Perc. across report duration (equivalent to 3 days out of 30)"]

topic Re: Please advise on Licensing: Workload/Usage based Vs. Daily ingest which is better & why ? Thank u a million in Splunk Enterprise

Please advise on Licensing: Workload/Usage based Vs. Daily ingest which is better & why ? Thank u a million

Re: Please advise on Licensing: Workload/Usage based Vs. Daily ingest which is better & why ? Thank u a million

Re: Please advise on Licensing: Workload/Usage based Vs. Daily ingest which is better & why ? Thank u a million