Does anyone have a search that can break down KBs by sourcetype?

dcroteau — Tue, 23 Jun 2020 18:44:32 GMT

Does anyone have a search that can break down kbs by sourcetype?

Re: License usage by sourcetype

Lowell — Wed, 05 May 2010 20:15:45 GMT

Here is a search you may find helpful, it does not 100% correlate to license usage, but you can get it pretty close by filtering out internal sourcetypes.

index=_internal sourcetype=splunkd source=*metrics* "group=per_sourcetype_thruput" NOT series="filetrackercrclog" NOT series="splunk*" NOT series="audittrail" NOT series="scheduler" NOT series="searches" NOT series="stash" | eval events=eps*kb/kbps | stats sum(events) as events sum(kb) as kb by series | eval events=round(events,0) | eval kb=round(kb,1)

This search gives you the event count and kb by series (in this case series means sourcetype).

Note that this is assuming your are on the latest 4.0.x release or any 4.1.x release, otherwise you should take out the NOT series="stash" part because summary indexing does count towards your licensing in older releases.

I've run into issues trying to do meaningful things with the kbps metric for 2 reasons:

if you are looking at long-term analysis, you can't do much with it because it's already an average, so doing avg(kbps) further skews your number.
Metrics are only recorded for series that are part of the top 10 active series. So it's likely that a sourcetype that varies in volume during the day will drop out of sight until the volume level increases again. Normally this isn't too big of a deal... (BTW, you can change the number of series to capture in limits.conf, look for the metrics stanza.)

If you are simply trying to get a view of activity at this moment or look for spikes, then kbps can be helpful, but for longer-term analysis I recommend looking at actual data indexed in terms of kb or events.

I wish that splunk gave you some additional metrics that indicated what was counting towards your license usage, but I don't think that information exists (other than the daily LicenseManager-Audit message). I think this is as good as it gets in the current release.

Re: License usage by sourcetype

tawollen — Thu, 05 Aug 2010 22:20:55 GMT

I am looking for something similar, I want to get a breakdwon by not only sourcetype, but by server.

Ideally, I want a chart that has:

Sourcetype Hostname Events KB

I would take something that just has events, and not KB as well.

Re: License usage by sourcetype

cdthompso1 — Thu, 19 Aug 2010 23:36:06 GMT

One option is to install the "Splunk License Usage" app available here.

http://www.splunkbase.com/apps/All/4.x/App/app:Splunk+License+Usage

Re: License usage by sourcetype

stanwin — Mon, 28 Sep 2020 20:21:43 GMT

Search relevant for this Question from the app:

kBs Indexed in Past 24 Hours by Sourcetype

search = index="_internal" source="*metrics.log" per_sourcetype_thruput | timechart sum(kb) by series

topic Re: License usage by sourcetype in Installation

Does anyone have a search that can break down KBs by sourcetype?

Re: License usage by sourcetype

Re: License usage by sourcetype

Re: License usage by sourcetype

Re: License usage by sourcetype