topic Re: Need to pull the Top 100 Hosts License Usage In Splunk Cloud in Splunk Search

Need to pull the Top 100 Hosts License Usage In Splunk Cloud

anandhalagaras1 — Mon, 10 Jun 2024 07:58:37 GMT

Need to pull the License Usage in GB for the top 100 Host along with their respective Index Source and Souretype information on monthly basis for reports.

So kindly help with the query.

Re: Need to pull the Top 100 Hosts License Usage In Splunk Cloud

gcasaldi — Mon, 10 Jun 2024 08:18:58 GMT

You can achieve this by leveraging internal indexes and configuring a report. Here's how:

Search Query below

This search query retrieves license usage data by host for a specific time range:

index=_internal source=*license_usage.log type="Usage" | eval host=lower(host) # Standardize hostname (optional) | eval MB=b/1024/1024 # Convert bytes to Megabytes | eval GB=round(MB/1024,2) # Convert Megabytes to Gigabytes (round to 2 decimals) | search earliest=-1mo@d latest=now@d # Adjust timeframe as needed (e.g., -3mo@d for past 3 months) | sort - GB # Sort by license usage in descending order | head 100 # Limit results to top 100 hosts | table host GB source sourcetype

Re: Need to pull the Top 100 Hosts License Usage In Splunk Cloud

anandhalagaras1 — Mon, 10 Jun 2024 08:36:32 GMT

@gcasaldi ,

Thank you for your prompt response. For example, I want to pull the report for the entire month of May (from May 1st to May 31st, 2024) for the top 100 hosts by license usage, along with their index, host, source, and sourcetype. I used the following query:

However, the query seems to be running continuously and does not produce any results. It is still running when I search for the previous month in the Search and Reporting app. Could you please let me know where I might have made a mistake?

Re: Need to pull the Top 100 Hosts License Usage In Splunk Cloud

gcasaldi — Mon, 10 Jun 2024 08:57:11 GMT

Re: Need to pull the Top 100 Hosts License Usage In Splunk Cloud

anandhalagaras1 — Mon, 10 Jun 2024 09:02:12 GMT

@gcasaldi

Here it just pulls the cluster master server information with GB when I ran the query for last month and not any other results. Refer screenshot for reference.

Re: Need to pull the Top 100 Hosts License Usage In Splunk Cloud

gcasaldi — Mon, 10 Jun 2024 10:33:07 GMT

right, change the index, for license:

Best,

Giulia

Re: Need to pull the Top 100 Hosts License Usage In Splunk Cloud

anandhalagaras1 — Tue, 11 Jun 2024 07:04:47 GMT

@gcasaldi Now also i am getting the hostname of Clustermaster and not the client machine information.

I need to get the top 100 client machines with their respective index source and sourcetype information