topic Will you help me fix my license usage by host query? in Splunk Search

Will you help me fix my license usage by host query?

vrmandadi — Wed, 12 Sep 2018 17:24:24 GMT

Hello All,

I am using Splunk version 7.1.0 for the Distributed Management Console (DMC) and I want to calculate the license usage by host. I am using the below query:

index=_internal source=*license_usage.log* type="Usage" |search h=*10d*
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) 
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) 
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
| bin _time span=1d 
| stats sum(b) as b

How can I get the value of "b" in GB? I am confused by the value of "b" . Is it in MB or any other metrics?

Re: Will you help me fix my license usage by host query?

vrmandadi — Wed, 12 Sep 2018 17:26:47 GMT

The value of b is 256722093 for the last 60 minutes

Re: Will you help me fix my license usage by host query?

harsmarvania57 — Wed, 12 Sep 2018 17:39:53 GMT

Hi,

Please try this

index=_internal source=*license_usage.log* type="Usage" |search h=*10d*
 | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) 
 | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) 
 | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
 | bin _time span=1d 
 | stats sum(b) as b
 | eval GB=round((((b/1024)/1024)/1024),2)

Re: Will you help me fix my license usage by host query?

vrmandadi — Wed, 12 Sep 2018 17:42:26 GMT

Thank you for your reply but what is the unit of b ?

Re: Will you help me fix my license usage by host query?

harsmarvania57 — Wed, 12 Sep 2018 17:45:15 GMT

b is in bytes