topic Re: Estimating Cost By Sourcetype in Monitoring Splunk

Estimating Cost By Sourcetype

daniel333 — Thu, 01 Oct 2020 00:01:09 GMT

All,

Just trying to get a swag of cost by sourcetype. I wrote this search, but seems to me there is a more cost effective way to do this.

Re: Estimating Cost By Sourcetype

inventsekar — Thu, 01 Oct 2020 00:16:06 GMT

Hi @daniel333 ...so this case depends on your own log, not a generic one like apache logs/win basic logs, etc..

if its a generic log, others would have had this issue and they can give suggestions.

May i know if this use-case is to understand that which sourcetype consumed how much splunk license cost?

if yes, maybe other users also have had this issue and they can give some suggestions.

(PS - i have given around 500+ karma points so far, received badge for that, if an answer helped you, a karma point would be nice!. we all should start "Learn, Give Back, Have Fun")

Re: Estimating Cost By Sourcetype

bowesmana — Thu, 01 Oct 2020 01:03:12 GMT

Have a look at some of these

https://community.splunk.com/t5/Splunk-Search/LIcense-Usage-by-Source-Type/m-p/212010

https://community.splunk.com/t5/Splunk-Search/Splunk-license-usage-per-sourcetype/m-p/367029

https://community.splunk.com/t5/Splunk-Search/How-do-I-search-the-license-usage-by-sourcetype-for-a-particular/m-p/260423

You can also look at tstats, metadata and eventcount commands, which will definitely run faster than the search you are doing