topic Re: Query for monthly usage of index in Splunk Search

Query for monthly usage of index

rickdi — Fri, 13 Mar 2015 15:40:47 GMT

I am very new to Splunk I am trying to figure out how to do a query of monthly usage of index of Splunk.

I have tried several different queries but I am not getting any results back. The person who set it up does ave the app SOS installed.

Any help would be much appreciated.

Re: Query for monthly usage of index

somesoni2 — Fri, 13 Mar 2015 16:13:20 GMT

By usage of index you mean data indexed in Splunk?? If yes, then you can see the license usage in SoS here.

http://yoursplunkserverURL/en-US/app/sos/license_usage_30days

Re: Query for monthly usage of index

cpetterborg — Fri, 13 Mar 2015 16:20:13 GMT

You are probably going to want to do a Summary Index search so that your searches are quicker if you have lots of data. I do a summary search every day at about 5AM for the previous day using the following search:

index=_internal source=*license_usage.log type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | stats sum(b) as b by idx | eval GB=(b/1024/1024/1024) | sort -GB | fields - b

I use an additional value in the summary table of report_type=daily_usage so that it will be unique.

Then the query to do a roll-up of a month of data, you can use something like:

index=summary report_type=daily_usage | stats sum(GB) as total by idx | eventstats sum(total) as GrandTotal | eval percent=round(total/GrandTotal*100,1) | sort -total

This should get you a report of the total of each index by month. We do this because we have separate indexes for different departments and are doing a show-back (instead of a charge-back) of their Splunk usage.

Re: Query for monthly usage of index

hexx — Fri, 13 Mar 2015 17:13:20 GMT

If you are running Splunk Enterprise 6.0 or higher, you will find that we ship a built-in License Usage Report view which, when consulted from your license master, allows to report on daily license usage per index out of the box.

Note that most of the searches behind the "Last 30 days" tab of this view are powered by a "datacube" search that can be accelerated on demand to ensure that the panels grouping daily license usage by index, source, sourcetype and host load fast.

Finally, as @somesoni2 mentions if you are still running Splunk Enterprise 5.x, you will find a copy of the same view in S.o.S titled "License Usage - Last 30 Days".

Re: Query for monthly usage of index

rickdi — Sat, 14 Mar 2015 04:05:50 GMT

Thank you so much I will try these out.