https://community.splunk.com/t5/Splunk-Search/Search-string-to-method-to-determine-heavy-hitter-servers-by/m-p/22234#M3800 <P>Yes you r right. I am assuming licensing usage by operating system, split down by hostnames which has the os installed.</P> Fri, 02 Aug 2013 14:08:45 GMT OMohi 2013-08-02T14:08:45Z https://community.splunk.com/t5/Splunk-Search/Search-string-to-method-to-determine-heavy-hitter-servers-by/m-p/22231#M3797 <P>Hi:</P> <P>Is there a procedure or a search string to determine heavy hitter hostname based on operating system. We work on five different operating systems and would like to determine the usage based per os level.</P> <P>Thanks,<BR /> Obaid</P> Thu, 01 Aug 2013 15:50:00 GMT https://community.splunk.com/t5/Splunk-Search/Search-string-to-method-to-determine-heavy-hitter-servers-by/m-p/22231#M3797 OMohi 2013-08-01T15:50:00Z https://community.splunk.com/t5/Splunk-Search/Search-string-to-method-to-determine-heavy-hitter-servers-by/m-p/22232#M3798 <P>You could tag your hostnames with the OS, and split your query by that tag. Alternatively, you can do the same with a lookup.</P> Fri, 02 Aug 2013 11:41:34 GMT https://community.splunk.com/t5/Splunk-Search/Search-string-to-method-to-determine-heavy-hitter-servers-by/m-p/22232#M3798 martin_mueller 2013-08-02T11:41:34Z https://community.splunk.com/t5/Splunk-Search/Search-string-to-method-to-determine-heavy-hitter-servers-by/m-p/22233#M3799 <P>Assuming you mean license usage?</P> Fri, 02 Aug 2013 13:23:08 GMT https://community.splunk.com/t5/Splunk-Search/Search-string-to-method-to-determine-heavy-hitter-servers-by/m-p/22233#M3799 sowings 2013-08-02T13:23:08Z https://community.splunk.com/t5/Splunk-Search/Search-string-to-method-to-determine-heavy-hitter-servers-by/m-p/22234#M3800 <P>Yes you r right. I am assuming licensing usage by operating system, split down by hostnames which has the os installed.</P> Fri, 02 Aug 2013 14:08:45 GMT https://community.splunk.com/t5/Splunk-Search/Search-string-to-method-to-determine-heavy-hitter-servers-by/m-p/22234#M3800 OMohi 2013-08-02T14:08:45Z https://community.splunk.com/t5/Splunk-Search/Search-string-to-method-to-determine-heavy-hitter-servers-by/m-p/22235#M3801 <P>Try the metrics.log. During each metrics dump (every 30 seconds), the "top X biggest Y" are written out. Where X is defaulted to ten (10), and Y is sourcetype, host, index, etc. The search string would read like:</P> <P><CODE><BR /> index=_internal source=*metrics.log group=tcpin_connections | stats sum(kb) AS kb by os<BR /> </CODE></P> <P>You could also use the results from the os field in the tcpin_connections, to evaluate the OS while getting the accurate license usage from license_usage.log.</P> Mon, 05 Aug 2013 14:12:52 GMT https://community.splunk.com/t5/Splunk-Search/Search-string-to-method-to-determine-heavy-hitter-servers-by/m-p/22235#M3801 sowings 2013-08-05T14:12:52Z https://community.splunk.com/t5/Splunk-Search/Search-string-to-method-to-determine-heavy-hitter-servers-by/m-p/22236#M3802 <P>could you break down the search to specify heavy hitters by host build using a particular o/s (eg windows)</P> Tue, 13 Aug 2013 08:46:58 GMT https://community.splunk.com/t5/Splunk-Search/Search-string-to-method-to-determine-heavy-hitter-servers-by/m-p/22236#M3802 OMohi 2013-08-13T08:46:58Z