topic Re: License Consumption Report Breakdown in Monitoring Splunk

License Consumption Report Breakdown

shocko — Fri, 04 Dec 2020 17:04:15 GMT

I have Splunk 8.0.5:

One cluster master
One Search head
Two indexers to host clustered indexes

I would like to create a weekly report showing:

License consumption per index, host, source, sourcetype
License consumption per index and thereafter broken down per host, source, sourcetype

Is there already some canned report for this (licensing dashboard?) or would anyone have a custom query?

Re: License Consumption Report Breakdown

richgalloway — Fri, 04 Dec 2020 18:10:21 GMT

Have you looked at the Monitoring Console?

Re: License Consumption Report Breakdown

saravanan90 — Fri, 18 Dec 2020 17:50:43 GMT

1. Query to get the license usage per day for index(idx), source(s), sourcetype(st) , host(h) can be pulled from license_usage file. Use the values mentioned in brackets in the timechart.

For each index:

index=_internal host=licenseserver source="*license_usage.log" type=usage idx="*" | eval MB = round(b/1048576,2) | eval st_idx = idx | timechart span=1d sum(MB) by idx limit=0

2. To further drilldown. We can use the below query but this will calculate by going through each events.

index=* | eval esize=len(_raw) | stats sum(esize) as size by index host source sourcetype | eval size_in_GB=(size/1024/1024/1024)

Re: License Consumption Report Breakdown

shocko — Sun, 20 Dec 2020 22:01:25 GMT

Thanks for the reply! Just what I needed and much appreciated.