All,
Is there an accurate way of measuring how much a specific event is using of my licensing?
I have 1000+ severs logging into index=java. A subset of hosts are logging in debug mode (priority=debug) I'd like to see how much licensing is being burned through.
thanks
-Daniel
For getting the license usage from those hosts, use this (Splunk's native license usage log, run from your license master)
index=_internal sourcetype=splunkd source=*license_usage.log i=java (h=yourhost1 OR h=yourhost2...) | timechart span=1d sum(b) as gb | eval gb=round(gb/1024/1024/1024,2)
If you're looking for license usage per event,on basis of a custom field, then there is no license usage summary provided by splunk. You can use this, not 100% accurate, slow workaround
YOur base search to get debug logs | eval b=len(_raw) | timechart span=1d sum(b) as gb | eval gb=round(gb/1024/1024/1024,2)
For getting the license usage from those hosts, use this (Splunk's native license usage log, run from your license master)
index=_internal sourcetype=splunkd source=*license_usage.log i=java (h=yourhost1 OR h=yourhost2...) | timechart span=1d sum(b) as gb | eval gb=round(gb/1024/1024/1024,2)
If you're looking for license usage per event,on basis of a custom field, then there is no license usage summary provided by splunk. You can use this, not 100% accurate, slow workaround
YOur base search to get debug logs | eval b=len(_raw) | timechart span=1d sum(b) as gb | eval gb=round(gb/1024/1024/1024,2)
Are you asking for a method to determine license usage for index=java? If so, this question has been answered in this thread - https://answers.splunk.com/answers/4897/how-to-determine-daily-license-usage-in-gb.html.