License Use Search Question

[hartfoml]

I have a number of Linux systems that are reporting to the OS index

I need to move to an Organizational index

I can do this using the deployment server since they are all reporting to the DS

The organization is being charged by the amount of data they put in there index each day

I have a list of hosts [index=os host=server1 OR host=server2 OR host=server3 OR host=etc]

What would be the best way to fashion a search to see how much data per day will be added to the ORG index whan I move the 93 systems to the new index?

[lukejadamec · Accepted solution]

Here is one of my all time favorite searches:

index=_internal source=*metrics.log group=per_index_thruput series=ORG | eval totalGB = (kb/1024)/1024 | timechart span=1d sum(totalGB)

Change the series to what ever index you're looking for, or a number of indexes if you like, and run it for the time period you'd like to check.

EDIT:

Getting a pre-move estimate is rather tricky, because a host can write to more than one index. If you assume that the hosts you're moving only write to the OS index, then you can use this search for per_host_thruput.

index=_internal source=*metrics.log group=per_host_thruput series=hostA OR series=hostb OR series=hostc | eval totalGB = (kb/1024)/1024 | timechart span=1d sum(totalGB)

You may be able to group your hosts by similar names, or use a lookup.