Hi,
I want get the license usage by host and specifically for windows OS, I got host usage by below query, but if I add the tag=windows* its not given any output. Please suggest me
index=_internal source=*license_usage.log type=Usage
| stats sum(b) as bytes by h
| eval MB = round(bytes/1024/1024,1)
| fields h MB
| rename h as host
Thanks
Use following query to get Host -OS mapping
index=_internal (source=*metrics.log) |dedup os,hostname | rename hostname as host| table os,host
Save this a lookup table file (say host_os.csv), then use it to get the license usage by OS
index=_internal source=*license_usage.log type=Usage | stats sum(b) as bytes by h | eval MB = round(bytes/1024/1024,1) | fields h MB | lookup host_os.csv host as h | stats sum(bytes) as bytes by os