topic Re: How to create a search and dashboard to display the daily license volume usage per index? in Dashboards & Visualizations

How to create a search and dashboard to display the daily license volume usage per index?

sympatiko — Mon, 30 Mar 2015 06:27:16 GMT

Hi splunkers,

Good day! I just to ask if possible to see the per index volume usage? Let's just say I have multiple indexes like index1 index2 index3. Then I want to create a dashboard that will check index1 index2 and index3 daily volume usage? Is it possible?

Thanks,

Re: How to create a search and dashboard to display the daily license volume usage per index?

ngatchasandra — Mon, 30 Mar 2015 07:07:41 GMT

Hi sympatiko,
Try with this query, index=* OR index=_* |timechart span=1d count by index and you are going to see daily count by index.

Your query will be like: index=index1 OR index=index2 OR index= index3 |timechart span=1d count(volume) by index where volume is your field .

Re: How to create a search and dashboard to display the daily license volume usage per index?

satishsdange — Mon, 30 Mar 2015 07:11:29 GMT

If you are admin user, login into Splunk console -> Settings -> Indexes. It will give you index name, size, event count etc.

Re: How to create a search and dashboard to display the daily license volume usage per index?

Tanefo — Mon, 30 Mar 2015 07:17:13 GMT

hi
it yes possible
index=* OR index=_*| stats count(Volume) by index
you will need to replace Volume by the field name which represente your volume in the index
for other information concerning this please let me know.
thanks and regards

Re: How to create a search and dashboard to display the daily license volume usage per index?

sympatiko — Mon, 30 Mar 2015 07:46:11 GMT

Hi, thanks for the reply. Sorry Im just new to splunk, what is that particular field?

Re: How to create a search and dashboard to display the daily license volume usage per index?

sympatiko — Mon, 30 Mar 2015 07:46:17 GMT

Hi, thanks for the reply. Sorry Im just new to splunk, what is that particular field?

Re: How to create a search and dashboard to display the daily license volume usage per index?

sympatiko — Mon, 30 Mar 2015 07:47:26 GMT

By the way Im doing this in a cluster mode. RF=3 SF=3

Re: How to create a search and dashboard to display the daily license volume usage per index?

sympatiko — Mon, 30 Mar 2015 07:47:50 GMT

Hi, Im doing this in a cluster. Thanks

Re: How to create a search and dashboard to display the daily license volume usage per index?

Tanefo — Mon, 30 Mar 2015 08:05:07 GMT

sorry sympatiko move Volume and run just

index=* OR index=_*| stats count by index

it give you eventypes volume by index but if you want data volume( like MB, GB) i think that its not possible.
you can just see volume data in this path: -> Settings -> Indexes

Re: How to create a search and dashboard to display the daily license volume usage per index?

ngatchasandra — Mon, 30 Mar 2015 08:10:10 GMT

Try only with index=index1 OR index=index2 OR index= index3 |timechart span=1d count by index

Re: How to create a search and dashboard to display the daily license volume usage per index?

Tanefo — Mon, 30 Mar 2015 08:14:45 GMT

it give you eventypes volume by index but if you want data volume( like MB, GB) i think that its not possible

Re: How to create a search and dashboard to display the daily license volume usage per index?

ngatchasandra — Mon, 30 Mar 2015 12:33:08 GMT

Wich particular field?

Re: How to create a search and dashboard to display the daily license volume usage per index?

sympatiko — Mon, 30 Mar 2015 13:08:23 GMT

Thanks for your help. I'll give it a shot. Thanks so much, long live!

Re: How to create a search and dashboard to display the daily license volume usage per index?

sympatiko — Mon, 30 Mar 2015 13:09:15 GMT

Thanks casandra =). I'll try that one

Re: How to create a search and dashboard to display the daily license volume usage per index?

ChrisG — Mon, 30 Mar 2015 20:08:49 GMT

Are you using Splunk Enterprise 6.x? Use the License Usage Reporting View. Settings > Licensing > Usage Report. See About the Splunk Enterprise license usage report view in the Admin Manual for more information.

Re: How to create a search and dashboard to display the daily license volume usage per index?

masonmorales — Mon, 30 Mar 2015 20:44:06 GMT

You can check-out an app I wrote for this too, it's free: https://splunkbase.splunk.com/app/2678/

Re: How to create a search and dashboard to display the daily license volume usage per index?

ngatchasandra — Tue, 31 Mar 2015 08:03:15 GMT

Please if you don't satisfy let me now. If you satisfy, don't forget to vote.

Re: How to create a search and dashboard to display the daily license volume usage per index?

mendesjo — Thu, 25 Feb 2016 02:13:35 GMT

Why do these queries only show your top 10 indexes? I must be missing something obvious, It shows 10 indexes usually in a column.. but where are all the rest?

Re: How to create a search and dashboard to display the daily license volume usage per index?

mendesjo — Thu, 25 Feb 2016 02:18:41 GMT

what a great looking app. Like allot of other apps and queries you find on here try it or install it, doesn't work. Install it, no issue, load up the dashboard wow looks great. Let's use it.. go to license usage.. says populating, drum roll.. nothing no data.