All Apps and Add-ons

How to create dashboard for licensing information containing info like which meeting pools,indexers,host,source are utilizing more license?

abhi04
Communicator

How to create dashboard for licensing information containing info like which meeting pools,indexers,host,source are utilizing more license?

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

The core information you can find in index=_internal source=*license_usage.log type="Useage. You can use fields from that to add in the details you are interested in. It includes your host, index, source, sourcetype, splunk_server, and pool information. This search can be adjusted to your needs:

index=_internal source=*license_usage.log type="Usage"    | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)   | eval sourcetypename = st   | eval hostname= h | bin _time span=1d    | stats values(poolsz) as poolsz sum(b) as b by _time, indexname, sourcetypename, hostname | eval GB=(b/1024/1024/1024)  | eval pool=(poolsz/1024/1024/1024) | fields _time, indexname, sourcetypename, hostname, GB, pool

The key part of this search is how you group the time and run the stats. You can run the stats over as granular of data container as you'd like. This particular search breaks everything out to index, sourcetype, and host.

One thing to note will be if you run over the granularity of source or host, you may see some blank values that account for some of your data usage. This is due to squashing and is done to prevent high memory usage. More info on this can be found here: http://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/AboutSplunksLicenseUsageReportView#Split-by:.... You may adjust the squashing threshold as defined in that doc.

Please let me know if you have any questions on the search!

0 Karma

niketn
Legend

@abhi04 you might want to leverage existing Apps/dashboards
1) Monitoring Console App or Linces Usage Report within Splunk has dashboard for the same http://docs.splunk.com/Documentation/Splunk/latest/Admin/AboutSplunksLicenseUsageReportView
2) License Monitoring for Splunk App from Splunkbase
3) Meta Woot App from Splunkbase

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

splunker12er
Motivator
index=_internal source=*license_usage.log type="Usage" 
  | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
  | eval sourcetypename = st
  | bin _time span=1d 
  | stats sum(b) as b by _time, pool, indexname, sourcetypename
  | eval GB=round(b/1024/1024/1024, 3)
  | fields _time, indexname, sourcetypename, GB
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...