Hi All:
I need help in creating a 3 panel report for yesterday's license count, last week's average license count and last 30 days average license count.
Thanks,
Mohammed
for each panel your queries will be
<panel> -- for yesterday
<search>
<query>index=_internal source=*license_usage.log| stats sum(b) as b | eval GB= (b/1024*1024*1024)</query>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</search>
</panel>
<panel> -- for 7 days avg
<search>
<query>index=_internal source=*license_usage.log| stats sum(b) as b | eval GB= (b/(1024*1024*1024*7))</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
</search>
</panel>
<panel> -- for monthly avg
<search>
<query>index=_internal source=*license_usage.log| stats sum(b) as b | eval GB= (b/(1024*1024*1024*30))</query>
<earliest>-30d@d</earliest>
<latest>@d</latest>
</search>
</panel>
Thanks Vijeta, I was looking for a report that will have these searches and create three table with the results for yesterday's license count, last week's average license count and last 30 days average license count
You can use these queries to create a report, for three separate tables you would need to create a dashboard. Currenly in your monitoring console , under Indexes-License - you can see for today or last 30 days , for seeing by your date range you will have to use above queries and generate individual reports or create dashboard as per your need.