https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-license-usage-for-specific-sourcetype/m-p/374098#M109963 <P>Thank you for the reply. But i would like to know how data is that sourcetype sending to splunk before indexing .</P> Mon, 21 Aug 2017 18:38:12 GMT kteng2024 2017-08-21T18:38:12Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-license-usage-for-specific-sourcetype/m-p/374092#M109957 <P>Can i please know how to calculate license usage of a particular sourcetype from a specific host before indexing ? For example , i have host "webapp01" having a sourcetype "access_log" but i would like to calculate how much data this sourcetype is sending to splunk before indexing to understand license consumption .</P> Sat, 19 Aug 2017 17:25:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-license-usage-for-specific-sourcetype/m-p/374092#M109957 kteng2024 2017-08-19T17:25:50Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-license-usage-for-specific-sourcetype/m-p/374093#M109958 <P>Try this app<BR /> <A href="https://splunkbase.splunk.com/app/2949/">https://splunkbase.splunk.com/app/2949/</A></P> Sat, 19 Aug 2017 18:07:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-license-usage-for-specific-sourcetype/m-p/374093#M109958 muralikoppula 2017-08-19T18:07:19Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-license-usage-for-specific-sourcetype/m-p/374094#M109959 <P>hi kteng2024!</P> <P>Your best bet is to simply calculate the total size of your access.log on the server over a few of your busiest days. This should give you a pretty close estimate of how much license it will consume per day.</P> <P><CODE>ls -lah</CODE> should give you the access.log size in human readable in nix.</P> Sat, 19 Aug 2017 19:18:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-license-usage-for-specific-sourcetype/m-p/374094#M109959 mattymo 2017-08-19T19:18:28Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-license-usage-for-specific-sourcetype/m-p/374095#M109960 <P>Without downloading an app here is a search that should help:</P> <PRE><CODE>index=_internal source=*license_usage.log type="Usage" | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | eval sourcetypename = st | eval host=h | bin _time span=1d | stats sum(b) as b by _time, host, indexname, sourcetypename | eval GB=(b/1024/1024/1024) | fields _time, indexname, sourcetypename, host, GB | stats sum(GB) as GB by indexname, sourcetypename, host | search indexname=* sourcetypename=* host=* </CODE></PRE> <P>You can use the last pipe to filter what you want to see. One thing to be aware of is host/source reporting can sometimes get squashed and you may see blank values for hosts/sources at that granularity. This thread explains squashing pretty well: <A href="https://answers.splunk.com/answers/48542/blank-h-and-s-in-license-usage-log.html">https://answers.splunk.com/answers/48542/blank-h-and-s-in-license-usage-log.html</A>. </P> <P>There is a tunable setting in server.conf for this.</P> Mon, 21 Aug 2017 13:58:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-license-usage-for-specific-sourcetype/m-p/374095#M109960 mdsnmss 2017-08-21T13:58:06Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-license-usage-for-specific-sourcetype/m-p/374096#M109961 <P>this search could perhaps do the trick as well:<BR /> index=_internal source=*license_usage.log type=Usage h=yourhost | stats sum(b) AS bytes by st | eval MB= round(bytes/1024/1024,3) | fields st MB | rename st as Sourcetype | sort -MB</P> Tue, 29 Sep 2020 15:24:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-license-usage-for-specific-sourcetype/m-p/374096#M109961 preotesoiu 2020-09-29T15:24:30Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-license-usage-for-specific-sourcetype/m-p/374097#M109962 <P>I stick by this answer seeing as you asked PRE-INDEX. After indexing my vote goes to meta woot app FOR SURE!</P> Mon, 21 Aug 2017 15:57:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-license-usage-for-specific-sourcetype/m-p/374097#M109962 mattymo 2017-08-21T15:57:01Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-license-usage-for-specific-sourcetype/m-p/374098#M109963 <P>Thank you for the reply. But i would like to know how data is that sourcetype sending to splunk before indexing .</P> Mon, 21 Aug 2017 18:38:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-license-usage-for-specific-sourcetype/m-p/374098#M109963 kteng2024 2017-08-21T18:38:12Z