topic Re: How to generate a search to find license usage for a particular index for past 7 days sorted by host and source? in Splunk Search

How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

lwaddep1 — Tue, 20 Jun 2017 20:49:02 GMT

How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

Particular indexer is pumping lot of data recently, we want to have a report for the index by host and source for the past 7 days.

Re: How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

somesoni2 — Tue, 20 Jun 2017 21:11:50 GMT

Try this

index=_internal sourcetype=splunkd source=*license_usage.log type=Usage idx=YourIndexNameHere
| eval host=coalesce(h,"<<SQUASHED>>") | eval source=coalesce(s,"<<SQUASHED>>")
| stats sum(b) as usage by host source
| eval usageMB=round(usage/1024/1024,3)

Re: How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

lwaddep1 — Tue, 20 Jun 2017 21:35:32 GMT

Thanks for your response, i verified query it worked for past 7 days of usage. I want to break this per day for last 7 days. how can i do it?

Re: How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

somesoni2 — Tue, 20 Jun 2017 21:37:44 GMT

Like this

 index=_internal sourcetype=splunkd source=*license_usage.log type=Usage idx=YourIndexNameHere
| bucket span=1d _time
 | eval host=coalesce(h,"<<SQUASHED>>") | eval source=coalesce(s,"<<SQUASHED>>")
 | stats sum(b) as usage by _time host source
 | eval usageMB=round(usage/1024/1024,3)

Re: How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

lwaddep1 — Wed, 21 Jun 2017 20:32:10 GMT

Thanks for the quick response, appreciate your help.

Re: How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

lwaddep1 — Thu, 22 Jun 2017 22:14:37 GMT

what changes does it need if we want to capture the same data in a timechart ?

Re: How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

traxxasbreaker — Sat, 02 Sep 2017 11:34:26 GMT

Just want to note that this search will only show an accurate breakdown by source if your combination of indexes, sourcetype, sources, and hosts is below the "squashing threshold". Index and sourcetype are guaranteed to remain accurate with a large number of combinations but the others are not. See this answer for some more details.