topic Re: data ingestion in Monitoring Splunk

data ingestion

sverdhan — Thu, 03 Oct 2024 19:43:40 GMT

Hello everyone,

I have created a query that list sourectypes :

I would want to modify this query such that it also enlists the volume ingestion of these sourcetypes as well...Kindly suggest

Re: data ingestion

gcusello — Thu, 03 Oct 2024 14:16:34 GMT

Hi @sverdhan ,

Go in [Settings > Licensing > License Usage > Previous 60 days > Split by Sourcetype] and you'll have your search that will be:

index=_internal [`set_local_host`] source=*license_usage.log* type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st, h, idx | timechart span=1d sum(b) AS volumeB by st fixedrange=false | fields - _timediff | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]

Ciao.

Giuseppe