topic Re: LIcense Usage by Source Type in Splunk Search

LIcense Usage by Source Type

fmpa_isaac — Thu, 16 Jun 2016 15:27:58 GMT

Can someone help me include sourcetype to my search below? I am trying to run a report for the past 60 days and need it by Sourcetype or Host. However, I don't see sourcetype as a field to choose from. I know Splunk has a license usage report but I'm needing the data behind it and for the past 60 days.
Here is my search string.

index=_internal source=*license_usage.log* type=Usage | timechart span=1d sum(b) as bytes | eval GB = round(bytes/1024/1024/1024,2)

Thank you

Re: LIcense Usage by Source Type

javiergn — Thu, 16 Jun 2016 15:37:45 GMT

See if my answer here helps:

https://answers.splunk.com/answers/344834/how-to-get-a-license-report-with-sourcetypes-and-i.html

index=_internal source=*license_usage.log type="Usage" 
 | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
 | eval sourcetypename = st
 | bin _time span=1d 
 | stats sum(b) as b by _time, pool, indexname, sourcetypename
 | eval GB=round(b/1024/1024/1024, 3)
 | fields _time, indexname, sourcetypename, GB

Re: LIcense Usage by Source Type

fmpa_isaac — Thu, 16 Jun 2016 15:42:43 GMT

Yes, thank you Javier.

Re: LIcense Usage by Source Type

ddrillic — Thu, 16 Jun 2016 15:50:03 GMT

This one works -

index=_internal source="*license_usage.log*"
| timechart span=1d sum(eval(round(b/1024/1024/1024,5))) by idx

If we change it to -

index=_internal source="*license_usage.log*"
| timechart span=1d sum(eval(round(b/1024/1024/1024,5))) by sourcetype

The sourcetype ends up to be splunkd.

Re: LIcense Usage by Source Type

merp96 — Tue, 29 Sep 2020 14:08:04 GMT

change sourcetype to "st" . The query works

index=_internal source="license_usage.log"
| timechart span=1d sum(eval(round(b/1024/1024/1024,5))) by st

Re: LIcense Usage by Source Type

yannK — Fri, 07 Dec 2018 17:57:36 GMT

Below is an example for the volume per sourcetype. The detail per sourcetype and index is always completed (no squash_threshold )
The fields are "st" for sourcetype, and "idx" for index.

We use the time bucket to do the sum per day, but you could do otherwise.
Keep in mind that the license-master reports the daily usage a midnight (timezone of the license-master), not necessarily in your timezone.

#by sourcetype
index=_internal source=*license_usage.log* type="Usage"
| bucket _time span=1d
| stats sum(b) As bytes by _time st

#by index
index=_internal source=*license_usage.log* type="Usage"
| bucket _time span=1d
| stats sum(b) As bytes by _time idx

If you are looking for a volume per host, the field to group by is "h", (or source with "s") but then you may encounter the issue of the squash_threshold. We recommend to do something like

# by host 
index=_internal source=*license_usage.log* type="Usage"
| bucket _time span=1d
| filnull h,s value="missing"  | stats sum(b) As bytes  by _time h 

#by source
index=_internal source=*license_usage.log* type="Usage"
| bucket _time span=1d
| filnull h,s value="missing"  | stats sum(b) As bytes  by _time s

Re: LIcense Usage by Source Type

ctksplunkctk — Tue, 11 Feb 2020 04:32:51 GMT

Hi all,
If I want to gather the statistics day by day for seeing the trend of each type of data and for checking the usage of any new data on-board in the future.
How should I modify the query?