All Apps and Add-ons

Logging Volume by event

daniel333
Builder

All,

Is there an accurate way of measuring how much a specific event is using of my licensing?

I have 1000+ severs logging into index=java. A subset of hosts are logging in debug mode (priority=debug) I'd like to see how much licensing is being burned through.

thanks
-Daniel

0 Karma
1 Solution

somesoni2
Revered Legend

For getting the license usage from those hosts, use this (Splunk's native license usage log, run from your license master)

index=_internal sourcetype=splunkd source=*license_usage.log i=java (h=yourhost1 OR h=yourhost2...) | timechart span=1d sum(b) as gb | eval gb=round(gb/1024/1024/1024,2)

If you're looking for license usage per event,on basis of a custom field, then there is no license usage summary provided by splunk. You can use this, not 100% accurate, slow workaround

YOur base search to get debug logs | eval b=len(_raw) | timechart span=1d sum(b) as gb | eval gb=round(gb/1024/1024/1024,2)

View solution in original post

0 Karma

somesoni2
Revered Legend

For getting the license usage from those hosts, use this (Splunk's native license usage log, run from your license master)

index=_internal sourcetype=splunkd source=*license_usage.log i=java (h=yourhost1 OR h=yourhost2...) | timechart span=1d sum(b) as gb | eval gb=round(gb/1024/1024/1024,2)

If you're looking for license usage per event,on basis of a custom field, then there is no license usage summary provided by splunk. You can use this, not 100% accurate, slow workaround

YOur base search to get debug logs | eval b=len(_raw) | timechart span=1d sum(b) as gb | eval gb=round(gb/1024/1024/1024,2)
0 Karma

nswondem
Path Finder

Are you asking for a method to determine license usage for index=java? If so, this question has been answered in this thread - https://answers.splunk.com/answers/4897/how-to-determine-daily-license-usage-in-gb.html.

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...