How to create dashboard for licensing information containing info like which meeting pools,indexers,host,source are utilizing more license?

[abhi04]

How to create dashboard for licensing information containing info like which meeting pools,indexers,host,source are utilizing more license?

[mdsnmss]

The core information you can find in index=_internal source=*license_usage.log type="Useage. You can use fields from that to add in the details you are interested in. It includes your host, index, source, sourcetype, splunk_server, and pool information. This search can be adjusted to your needs:

index=_internal source=*license_usage.log type="Usage"    | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)   | eval sourcetypename = st   | eval hostname= h | bin _time span=1d    | stats values(poolsz) as poolsz sum(b) as b by _time, indexname, sourcetypename, hostname | eval GB=(b/1024/1024/1024)  | eval pool=(poolsz/1024/1024/1024) | fields _time, indexname, sourcetypename, hostname, GB, pool

The key part of this search is how you group the time and run the stats. You can run the stats over as granular of data container as you'd like. This particular search breaks everything out to index, sourcetype, and host.

One thing to note will be if you run over the granularity of source or host, you may see some blank values that account for some of your data usage. This is due to squashing and is done to prevent high memory usage. More info on this can be found here: http://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/AboutSplunksLicenseUsageReportView#Split-by:.... You may adjust the squashing threshold as defined in that doc.

Please let me know if you have any questions on the search!

[niketn]

@abhi04 you might want to leverage existing Apps/dashboards
1) Monitoring Console App or Linces Usage Report within Splunk has dashboard for the same http://docs.splunk.com/Documentation/Splunk/latest/Admin/AboutSplunksLicenseUsageReportView
2) License Monitoring for Splunk App from Splunkbase
3) Meta Woot App from Splunkbase

[splunker12er]

index=_internal source=*license_usage.log type="Usage" 
  | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
  | eval sourcetypename = st
  | bin _time span=1d 
  | stats sum(b) as b by _time, pool, indexname, sourcetypename
  | eval GB=round(b/1024/1024/1024, 3)
  | fields _time, indexname, sourcetypename, GB