Logging Volume by event

[daniel333]

All,

Is there an accurate way of measuring how much a specific event is using of my licensing?

I have 1000+ severs logging into index=java. A subset of hosts are logging in debug mode (priority=debug) I'd like to see how much licensing is being burned through.

thanks
-Daniel

[somesoni2 · Accepted solution]

For getting the license usage from those hosts, use this (Splunk's native license usage log, run from your license master)

index=_internal sourcetype=splunkd source=*license_usage.log i=java (h=yourhost1 OR h=yourhost2...) | timechart span=1d sum(b) as gb | eval gb=round(gb/1024/1024/1024,2)

If you're looking for license usage per event,on basis of a custom field, then there is no license usage summary provided by splunk. You can use this, not 100% accurate, slow workaround

YOur base search to get debug logs | eval b=len(_raw) | timechart span=1d sum(b) as gb | eval gb=round(gb/1024/1024/1024,2)

[nswondem]

Are you asking for a method to determine license usage for index=java? If so, this question has been answered in this thread - https://answers.splunk.com/answers/4897/how-to-determine-daily-license-usage-in-gb.html.