topic Re: How to search license usage by indexer server and top 10 host usage per indexer? in Getting Data In

How to search license usage by indexer server and top 10 host usage per indexer?

kpavan — Wed, 28 Jan 2015 15:19:07 GMT

Hi All,

I got a request to create report for License Usage by Indexer Server and Top 10 Host usage per Indexer Server. Could you please help me with search query so that I can achieve that request.

They need a report which says per day how much MB/GB License being utilized per Indexer server
And For each Indexer servers what are the top 10 host's contributing

Thanks in advance!

Re: How to search license usage by indexer server and top 10 host usage per indexer?

aholzer — Wed, 28 Jan 2015 15:54:34 GMT

Here's the answer to your first question:

index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d pool=* | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | eval mb = round(b/1024/1024,2)
| join type=left slave 
     [| rest count=0 /services/licenser/slaves 
     | rename label as slave_name
     | rename title as slave 
     | table slave_name slave]
| search mb!=0
| timechart span=1d sum(mb) AS "volume" fixedrange=false by slave_name

You should be able to manipulate the above to get the second question as well.

Hope this helps

Re: How to search license usage by indexer server and top 10 host usage per indexer?

sspomeplus — Mon, 25 Jul 2016 11:22:43 GMT

Search operation 'rest' is unknown. You might not have permission to run this operation.

Any suggestion?

Re: How to search license usage by indexer server and top 10 host usage per indexer?

somesoni2 — Mon, 25 Jul 2016 14:51:32 GMT

There was a pipe symbol missing in the rest subsearch. Try now.

Re: How to search license usage by indexer server and top 10 host usage per indexer?

sspomeplus — Thu, 28 Jul 2016 06:35:48 GMT

10x.

But in our case it's not working because the splunk version is < 5.
Any suggestion?