topic Re: Why is my license usage search by app not showing information for all apps in my environment? in Splunk Search

Why is my license usage search by app not showing information for all apps in my environment?

sunnyparmar — Thu, 04 Feb 2016 09:35:56 GMT

Hi,

I have a search mentioned below to see license usage per app, but the issue I am facing is, if I run the search without this portion ( | chart sum(GB) by app_name) at the end, then it gives the license usage for all apps with their indexes and sourcetypes respectively. However, if I exclude it from the end, then it is not showing license usage for all the apps. Kindly suggest for this.

index=_internal source=*license_usage.log type="Usage" | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)  | eval sourcetypename = st  | bin _time span=1d  | stats sum(b) as b by _time, pool, indexname, sourcetypename | eval GB=round(b/1024/1024/1024, 3)| fields _time, indexname, sourcetypename, GB |  join sourcetypename [       | rest /services/saved/sourcetypes       | fields title, "eai:acl.app"       | rename title AS sourcetypename, "eai:acl.app" AS app_name  ] | chart sum(GB) by app_name

Thanks

Re: Why is my license usage search by app not showing information for all apps in my environment?

renjith_nair — Thu, 04 Feb 2016 10:02:30 GMT

Not sure exactly but the same search works for me 🙂

index=_internal source="*license_usage.log" type="Usage" 
| eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | eval sourcetypename = st | bin _time span=1d 
| stats sum(b) as b by _time, pool, indexname, sourcetypename | eval GB=round(b/1024/1024/1024, 3)
| fields _time, indexname, sourcetypename, GB 
| join sourcetypename [ | rest /services/saved/sourcetypes | fields title, "eai:acl.app" | rename title AS sourcetypename, "eai:acl.app" AS app_name ]

Re: Why is my license usage search by app not showing information for all apps in my environment?

sunnyparmar — Thu, 04 Feb 2016 11:41:04 GMT

have you executed the query with adding parameter (| chart sum(GB) by app_name) in the last. Please let me know if it will show you all your apps in the result. Thanks

Re: Why is my license usage search by app not showing information for all apps in my environment?

renjith_nair — Thu, 04 Feb 2016 11:53:05 GMT

Yes I have only 2 apps in my test and they are showing like below

app_name                                                   sum(GB)
search                                                  0.000
splunk_app_windows_infrastructure   0.001

Final search I ran :

index=_internal source="*license_usage.log" type="Usage" 
 | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | eval sourcetypename = st | bin _time span=1d 
 | stats sum(b) as b by _time, pool, indexname, sourcetypename | eval GB=round(b/1024/1024/1024, 3)
 | fields _time, indexname, sourcetypename, GB 
 | join sourcetypename [ | rest /services/saved/sourcetypes | fields title, "eai:acl.app" | rename title AS sourcetypename, "eai:acl.app" AS app_name ]
 | chart sum(GB) by app_name

Are you getting some apps or not at all ?

Re: Why is my license usage search by app not showing information for all apps in my environment?

sunnyparmar — Thu, 04 Feb 2016 12:13:35 GMT

i am getting some app but not all.. what i want is to enlisted all the apps in the final result. Just don't understand why it behaves weird?

Re: Why is my license usage search by app not showing information for all apps in my environment?

renjith_nair — Thu, 04 Feb 2016 12:47:42 GMT

can you run below search and see if all these apps are showing in the original search ?

index=_internal source="*license_usage.log" type="Usage" 
  | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | eval sourcetypename = st | bin _time span=1d 
  | stats sum(b) as b by _time, pool, indexname, sourcetypename | eval GB=round(b/1024/1024/1024, 3)
  | fields _time, indexname, sourcetypename, GB 
  | join sourcetypename [ | rest /services/saved/sourcetypes | fields title, "eai:acl.app" | rename title AS sourcetypename, "eai:acl.app" AS app_name ]|table app_name|dedup app_name

    index=_internal source="*license_usage.log" type="Usage" 
      | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | eval sourcetypename = st | bin _time span=1d 
      | stats sum(b) as b by _time, pool, indexname, sourcetypename | eval GB=round(b/1024/1024/1024, 3)
      | fields _time, indexname, sourcetypename, GB 
      | join sourcetypename [ | rest /services/saved/sourcetypes | fields title, "eai:acl.app" | rename title AS sourcetypename, "eai:acl.app" AS app_name ]|stats count by app_name

And also check the next pages if there are (its obvious but just in case)

Re: Why is my license usage search by app not showing information for all apps in my environment?

sunnyparmar — Thu, 04 Feb 2016 13:33:09 GMT

I have executed both the queries and still 3 apps are missing in result in both queries..

Re: Why is my license usage search by app not showing information for all apps in my environment?

renjith_nair — Thu, 04 Feb 2016 14:27:45 GMT

Are those three apps coming as part of original detailed search ? Also those three apps have common sourcetypename to result in join ?

Re: Why is my license usage search by app not showing information for all apps in my environment?

sunnyparmar — Sun, 07 Feb 2016 06:47:34 GMT

Q - Are those three apps coming as part of original detailed search?
A - Yes..

Q - Also those three apps have common sourcetypename to result in join ?
A- Sorry, Didn't get you.

Re: Why is my license usage search by app not showing information for all apps in my environment?

renjith_nair — Sun, 07 Feb 2016 11:03:05 GMT

You have mentioned before, the result of the below search is missing the three app names. Then what you mean by "Yes" to the question " Are those three apps coming as part of original detailed search?" . Sorry just trying to understand the problem.

 index=_internal source="*license_usage.log" type="Usage" 
   | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | eval sourcetypename = st | bin _time span=1d 
   | stats sum(b) as b by _time, pool, indexname, sourcetypename | eval GB=round(b/1024/1024/1024, 3)
   | fields _time, indexname, sourcetypename, GB 
   | join sourcetypename [ | rest /services/saved/sourcetypes | fields title, "eai:acl.app" | rename title AS sourcetypename, "eai:acl.app" AS app_name ]|table app_name|dedup app_name

If you are not getting those three apps as part of this search, then it could be your join is eliminating the apps (few sourcetypes missing from any of the two searches)
Try this again and see if you have any "Not Found" in app name.

   index=_internal source="*license_usage.log" type="Usage" 
       | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | eval sourcetypename = st | bin _time span=1d 
       | stats sum(b) as b by _time, pool, indexname, sourcetypename | eval GB=round(b/1024/1024/1024, 3)
       | fields _time, indexname, sourcetypename, GB 
       | join sourcetypename type=outer [ | rest /services/saved/sourcetypes | fields title, "eai:acl.app" | rename title AS sourcetypename, "eai:acl.app" AS app_name ]|eval app_name=coalesce(app_name,"Not Found" |stats count by app_name

If the above is also not working for youo then get one of the app from the missing three and then search for it in the results of original detailed search(the main search with join)

Re: Why is my license usage search by app not showing information for all apps in my environment?

sunnyparmar — Sun, 07 Feb 2016 13:08:41 GMT

sorry .. took your first question in wrong meaning. First question answer is "no". those three apps are not the part of original detailed search as i was mentioned earlier. By executing your above given query i am getting the error message below -

"Error in 'eval' command: The expression is malformed. Expected ). "

Thanks

Re: Why is my license usage search by app not showing information for all apps in my environment?

renjith_nair — Sun, 07 Feb 2016 14:54:26 GMT

no problem. I missed a ")" in eval . just replace it with|eval app_name=coalesce(app_name,"Not Found")|stats count by app_name

OK so if it's not in your detailed search, it's not the problem with stats. Now we need to look at the join command. It's possible that the sourcetypes from your missing 'three' apps might not be sending the data and hence the sourcetype is not matching in "join" . Get the sourcetypes from those missing apps and see if it's sending any data.

Hope now you will be able to identify the reason.

Re: Why is my license usage search by app not showing information for all apps in my environment?

sunnyparmar — Mon, 08 Feb 2016 06:14:26 GMT

Thanks for the correction. Now i have start getting data in "Not found". The index and sourcetype i am getting is -

 index                       sourcetype

qv-perfmon Perfmon:CPUTime

qv-perfmon Perfmon:FreeDiskSpace

qv-perfmon Perfmon:Memory

qv-winevents WinEventLog:Application

qv-winevents WinEventLog:Security

qv-winevents WinEventLog:System

Now the issue is that these are common sourcetypes as you know that while fetching logs for host health checks in splunk these are the common sourcetypes that we have to define in inputs.conf file so could you please tell me that how to overcome through this issue.

Thanks

Re: Why is my license usage search by app not showing information for all apps in my environment?

sunnyparmar — Mon, 08 Feb 2016 06:30:38 GMT

thanks for the correction. By executing that query i am getting data in "Not Found".

Index Sourcetype
qv-perfmon Perfmon:CPUTime

qv-perfmon Perfmon:FreeDiskSpace

qv-perfmon Perfmon:Memory

qv-winevents WinEventLog:Application

qv-winevents WinEventLog:Security

qv-winevents WinEventLog:System

But now the issue here is it is very common sourcetype that we used in splunk for making alerts for host health checks and make entries in inputs.conf so in this case could you please tell me how to overcome this issue?

Thanks

Re: Why is my license usage search by app not showing information for all apps in my environment?

sunnyparmar — Mon, 08 Feb 2016 07:24:15 GMT

By using below parameter i am able to enlisted all the apps in the result but when i am going to replace it with my final search query parameter (| rest /services/saved/sourcetypes ), it won't work. Do you have any idea on this?

| REST /services/apps/local splunk_server=local | table label

Thanks

Re: Why is my license usage search by app not showing information for all apps in my environment?

renjith_nair — Mon, 08 Feb 2016 09:29:46 GMT

Your alerts/searches are not aaffected by this. The above sourcetypes might not be part of any app and hence app_name is not displayed.

Again to find out the missing apps , let's do step by step

Take one of the apps from the missing list (let's say app1)
Find out its sourcetypes | rest /services/saved/sourcetypes | fields title, "eai:acl.app" | rename title AS sourcetypename, "eai:acl.app" AS app_name|search app_name="app1"
Check those sourcetypes are part of your license search index=_internal source="*license_usage.log" type="Usage" st="sourcetypes from stpe2"
If you don't get any results for step3 , the app1 is not sending any data and hence its missing since you have a join to map the sourcetypes. So it results only those apps which has a matching sourcetype in your "license search"
In case you find it out, try changing the time range of your initial search to something bigger ,let's say last 30 days

Re: Why is my license usage search by app not showing information for all apps in my environment?

sunnyparmar — Mon, 08 Feb 2016 09:44:57 GMT

hey, on executing your both queries (2 & 3) it is giving me "no result found". Thanks

Re: Why is my license usage search by app not showing information for all apps in my environment?

sunnyparmar — Tue, 29 Sep 2020 08:42:30 GMT

Well sorry once again as i am executing wrong previously.. so now what I comes up with final result is after running 2nd point query is -
sourcetypename app_name
Alusta_Validation Alusta_Tenant_Validation
and when i am providing the sourcetype in 3rd point query so it is giving "no result found". so now could you please tell me that how to merge Alusta_validation sourcetype with join.

Thanks

Re: Why is my license usage search by app not showing information for all apps in my environment?

renjith_nair — Mon, 08 Feb 2016 11:18:04 GMT

Can you try this for the time range you are using in your license search

index=* sourcetype="Alusta_Validation"|stats count

If you are not getting any result for this, there is no data indexing for this sourcetype. If there is no data indexing for the sourcetype, it does not make sense to include it as part of license usage

Re: Why is my license usage search by app not showing information for all apps in my environment?

sunnyparmar — Mon, 08 Feb 2016 11:34:58 GMT

it is showing the last logs of September 2015. After that there is no logs detail.