topic Re: Hourly License Usage in Installation

Hourly License Usage

rrjcraft — Tue, 10 Dec 2013 19:54:49 GMT

How would you go about retrieving the License Usage by Hour in GB?

Re: Hourly License Usage

lukejadamec — Tue, 10 Dec 2013 20:01:36 GMT

Run this search for whatever timeframe you like - it does not count all indexed data, just the data that counts against your license:

index=_internal source=*license_usage.log type=Usage 
| stats sum(b) as bytes 
| eval GB = round(bytes/1024/1024/1024,5)
| fields GB

In chart form:

index=_internal source=*license_usage.log type=Usage 
| stats sum(b) as bytes by date_hour 
| eval GB = round(bytes/1024/1024/1024,5) 
| table date_hour,GB

You will need to specify the timerange. Switch from table to chart with the chart button in the upper left.

Re: Hourly License Usage

rrjcraft — Tue, 10 Dec 2013 20:19:36 GMT

That is the tricky part. How would you go about having it display per hour? That query appears to calculate GB for all time.

Re: Hourly License Usage

lukejadamec — Tue, 10 Dec 2013 20:23:38 GMT

Use the time picker to select what time frame to check. Last 60 minutes will give you the last hour. Today will give you the amount indexed today.

Standby and I'll update the search to give an hourly chart.

Re: Hourly License Usage

yannK — Tue, 10 Dec 2013 20:54:00 GMT

Per hour, use timechart

index=_internal source=*license_usage.log* type=Usage | timechart span=1h sum(b) as bytes | eval GB = round(bytes/1024/1024/1024,5) | fields _time GB

or use a bucketing per hour with stats

index=_internal source=*license_usage.log* type=Usage | bucket _time span=1h | stats sum(b) as bytes by _time | eval GB = round(bytes/1024/1024/1024,5) | fields _time GB

Re: Hourly License Usage

rrjcraft — Tue, 10 Dec 2013 21:42:59 GMT

I'm not sure what the bucketing means

Re: Hourly License Usage

yannK — Tue, 10 Dec 2013 21:47:52 GMT

This is the bucket command, that regroup events based on a field, and normalize them.
see http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Bucket

If you use for the _time, it will replace all the _time by the first value of the span, here every events of the hour will have the same timestamp, the first second of the hour.