https://community.splunk.com/t5/Getting-Data-In/Splunk-Host-problem/m-p/178504#M35791 <P>Thank you very much for your answer, however what I get as a result is the time the Sum(Gb) and what appears in the H column is my Splunk Server. IT as if splunk sees my splunk server as a host and then all the rest of my ossec agents as reporting_host.</P> Mon, 16 Dec 2013 13:21:19 GMT alaquerre 2013-12-16T13:21:19Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Host-problem/m-p/178502#M35789 <P>Hi ,</P> <P>I currently have a problem with my reporting host. I am trying to solve a license violation issue but cannot find the search command in order to view the top reporting host based on how much space it is taking in mb.</P> <P>When I look up by host, I only get one host instead of 35. It is as if splunk has declared my 35 agents as being reporting host instead of hosts.</P> <P>Any help on this would be greatly apprecaited</P> Fri, 13 Dec 2013 17:21:54 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Host-problem/m-p/178502#M35789 alaquerre 2013-12-13T17:21:54Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Host-problem/m-p/178503#M35790 <P>Use this:</P> <PRE><CODE>index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | bucket _time span=1d | stats sum(GB) by _time,h </CODE></PRE> <P>Enjoy!</P> Fri, 13 Dec 2013 18:16:04 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Host-problem/m-p/178503#M35790 jtrucks 2013-12-13T18:16:04Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Host-problem/m-p/178504#M35791 <P>Thank you very much for your answer, however what I get as a result is the time the Sum(Gb) and what appears in the H column is my Splunk Server. IT as if splunk sees my splunk server as a host and then all the rest of my ossec agents as reporting_host.</P> Mon, 16 Dec 2013 13:21:19 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Host-problem/m-p/178504#M35791 alaquerre 2013-12-16T13:21:19Z