topic Re: How to run license report on certain index/sourcetype combinations in Installation

How to run a license report on certain index/sourcetype combinations?

a212830 — Mon, 15 Jun 2020 22:50:03 GMT

Hi,

I need to run a report in MB for the last 7 days on a specific index and sourcetype combinations. I have this as a reference, but it filters on pool.

index=_internal source=*license_usage.log* type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st, h, idx  | search pool="ECS Licensing" | timechart span=1d sum(b) AS volumeB by st fixedrange=false  | join type=outer _time [search index=_internal [`set_local_host`] source=*license_usage.log* type="RolloverSummary" earliest=-7d@d  | search pool="ECS Licensing" | eval _time=_time - 43200 | bin _time span=1d | stats latest(poolsz) AS  "pool size" by _time] | fields - _timediff  | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]

Re: How to run license report on certain index/sourcetype combinations

harsmarvania57 — Fri, 29 Dec 2017 02:49:29 GMT

Hi @a212830,

Please try

index=_internal source=*license_usage.log* type="Usage" | stats sum(b) AS Bytes by idx,st | eval MB=(Bytes/1024)/1024 | rename idx AS Index, st AS Sourcetype | table Index, Sourcetype, MB

Above query will give you license usage by Index and Sourcetype.

If you want to run report against specific Index and Sourcetype then you can run

index=_internal source=*license_usage.log* type="Usage" idx=<Index Name> st=<sourcetype> | stats sum(b) AS Bytes by idx,st | eval MB=(Bytes/1024)/1024 | rename idx AS Index, st AS Sourcetype | table Index, Sourcetype, MB

If you want to count license usage on per day basis then you can include | bin _time span=1d in your query so your query will be

index=_internal source=*license_usage.log* type="Usage" idx=<Index Name> st=<sourcetype> | bin _time span=1d | stats sum(b) AS Bytes by idx,st | eval MB=(Bytes/1024)/1024 | rename idx AS Index, st AS Sourcetype | table Index, Sourcetype, MB

I hope this helps.

Thanks,
Harshil

Re: How to run license report on certain index/sourcetype combinations

niketn — Fri, 29 Dec 2017 03:15:04 GMT

Try the Meta Woot app for Splunk from Splunkbase.

Re: How to run license report on certain index/sourcetype combinations

a212830 — Fri, 29 Dec 2017 03:33:50 GMT

Thanks. It's giving me a total for each unique pair, but not by day.

Re: How to run license report on certain index/sourcetype combinations

harsmarvania57 — Fri, 29 Dec 2017 05:46:34 GMT

EDIT: Updated query.

Re: How to run license report on certain index/sourcetype combinations

a212830 — Fri, 29 Dec 2017 13:09:16 GMT

Same thing - there is no date breakdown when I list it for 7 days.

Re: How to run license report on certain index/sourcetype combinations

harsmarvania57 — Fri, 29 Dec 2017 13:14:55 GMT

I have updated query in my earlier comment, can you please try that?

If that will not work then try this one index=_internal source=*license_usage.log* type="Usage" | bin _time span=1d| stats sum(b) AS Bytes by idx,st,_time| eval MB=(Bytes/1024)/1024 | rename idx AS Index, st AS Sourcetype | table _time,Index, Sourcetype, MB

EDIT: Updated query