topic Re: How do I find which host is using the most data in Splunk 6.2.2 and causing a license violation? in Installation

How do I find which host is using the most data in Splunk 6.2.2 and causing a license violation?

duanehare — Mon, 22 Jun 2020 23:20:26 GMT

I am using Splunk 6.2.2 and all of a sudden, I am violating my indexing license. When I run the License Usage Report split by Host, the large chunk of data is returned to as the host "OTHER".

Re: How do I find which host is using the most data in Splunk 6.2.2 and causing a license violation?

MuS — Tue, 10 Nov 2015 19:56:12 GMT

Hi duanehare,

run this search, which is basically the same from the license usage report but with added useother=f usenull=f so you no longer have the OTHER group in the time chart:

index=_internal source=*license_usage.log type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st, h, idx   | join _time pool type=outer [search index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(stacksz) AS stacksz by slave, pool, _time | stats max(stacksz) AS stacksz by _time, pool] | stats sum(b) AS bytes_used max(stacksz) AS stacksz by h, _time | timechart span=1d max(eval(round(bytes_used/stacksz*100,2))) by h fixedrange=false useother=f usenull=f

Hope this helps ...

cheers, MuS

Re: How do I find which host is using the most data in Splunk 6.2.2 and causing a license violation?

duanehare — Wed, 11 Nov 2015 20:01:38 GMT

I ran this query and it returned 0 events. Suggestions?

Re: How do I find which host is using the most data in Splunk 6.2.2 and causing a license violation?

MuS — Wed, 11 Nov 2015 20:12:58 GMT

do you have access to index=_internal ? run this search:

 index=_internal host=indexer source=*license_usage.log type="Usage"

The above search is the one from the License Usage Report, just added the useother=f usenull=f options....

Re: How do I find which host is using the most data in Splunk 6.2.2 and causing a license violation?

MuS — Wed, 11 Nov 2015 20:13:36 GMT

ahh just found the error 🙂 remove host=indexer from the search !

Re: How do I find which host is using the most data in Splunk 6.2.2 and causing a license violation?

MuS — Wed, 11 Nov 2015 20:14:19 GMT

Just updated the answer and the search

Re: How do I find which host is using the most data in Splunk 6.2.2 and causing a license violation?

Abilan1 — Tue, 29 Sep 2020 07:54:11 GMT

Hi ,

Please try the below one,

index=_internal source=*license_usage.log type=Usage
| stats sum(b) as bytes by h
| eval MB = round(bytes/1024/1024,1)
| fields h MB
| rename h as host