https://community.splunk.com/t5/Splunk-Search/help-with-timechart-count-needed/m-p/397450#M172065 <P>Hello,</P> <P>I would like to track the license consumption as from time to time it is 4 times higher (per day) than expected. I suspect this is because our systems are in the QEC phase and produce more logs, e.g. after someone activates additional traces/debug mode.<BR /> I am identifying the file / source type responsible for the growth using the following:</P> <PRE><CODE>index=si_license_usage idx="mlbso" st=BWP_hanatraces | eval Gb=round(b_hourly/1024/1024/1024,12) | bucket span=1d _time |sort -b_hourly </CODE></PRE> <P>What comes out is that the files with the pattern <EM>indexserver</EM> are causing the most consumption. This is expected.<BR /> As they have restricted size, I would be now interested to see how often they are written / transferred to Splunk.<BR /> So I thought I would use sth. like below to get the chart of the distinct files / sources per hour:</P> <PRE><CODE>| metadata type=sources index=mlbso sourcetype=BWP* | search source="*indexserver*" | timechart span=1h count </CODE></PRE> <P>but the last part with timechart does not return any result, so I guess I do sth wrong.<BR /> Could you please help? </P> <P>Kind Regards,<BR /> Kamil</P> Wed, 03 Apr 2019 08:45:53 GMT damucka 2019-04-03T08:45:53Z https://community.splunk.com/t5/Splunk-Search/help-with-timechart-count-needed/m-p/397450#M172065 <P>Hello,</P> <P>I would like to track the license consumption as from time to time it is 4 times higher (per day) than expected. I suspect this is because our systems are in the QEC phase and produce more logs, e.g. after someone activates additional traces/debug mode.<BR /> I am identifying the file / source type responsible for the growth using the following:</P> <PRE><CODE>index=si_license_usage idx="mlbso" st=BWP_hanatraces | eval Gb=round(b_hourly/1024/1024/1024,12) | bucket span=1d _time |sort -b_hourly </CODE></PRE> <P>What comes out is that the files with the pattern <EM>indexserver</EM> are causing the most consumption. This is expected.<BR /> As they have restricted size, I would be now interested to see how often they are written / transferred to Splunk.<BR /> So I thought I would use sth. like below to get the chart of the distinct files / sources per hour:</P> <PRE><CODE>| metadata type=sources index=mlbso sourcetype=BWP* | search source="*indexserver*" | timechart span=1h count </CODE></PRE> <P>but the last part with timechart does not return any result, so I guess I do sth wrong.<BR /> Could you please help? </P> <P>Kind Regards,<BR /> Kamil</P> Wed, 03 Apr 2019 08:45:53 GMT https://community.splunk.com/t5/Splunk-Search/help-with-timechart-count-needed/m-p/397450#M172065 damucka 2019-04-03T08:45:53Z https://community.splunk.com/t5/Splunk-Search/help-with-timechart-count-needed/m-p/397451#M172066 <P><CODE>| metadata</CODE> does not return an _time field. So without any further tricks, you cannot do a timechart on that. You would need to rename the relevant time field from the <CODE>| metadata</CODE> output to _time, before doing the timechart.</P> Wed, 03 Apr 2019 11:36:00 GMT https://community.splunk.com/t5/Splunk-Search/help-with-timechart-count-needed/m-p/397451#M172066 FrankVl 2019-04-03T11:36:00Z