All Apps and Add-ons

Splunk License Usage Reports

Communicator

I submitted a support request for this but perhaps someone can help me before they respond....

End goal -

Weekly emailed report that shows total license usage per day. I found this report under the deployment monitor that is close to what I would like "Daily Usage for Last 60 Days"

However when I view this report under Settings > "Searches, reports and Alerts" > Daily License Usage by Pool - last 60 days > Run - the date field is incorrectly displayed. Would like to attach image of this but I guess I need more karma...

The day field just has the numbers... 1418968800, 1419055200 etc... assuming it is a formatting issue??

Deployment monitor v 5.0.4
Splunk V 6.2.0

Thanks!
John

0 Karma
1 Solution

Motivator

Time is in epoch. use strftime command with %m-%d-%y %H:%M:%S as argument.

Example: Let's say the field xyz has the values 1418968800, 1419055200 etc..

use ....|eval Time = strftime(xyz,"%m-%d-%y %H:%M:%S"). Also, with 6 and above versions of Splunk, you have the license monitor embedded which should give you searches to tweak as per your needs.
Hope this helps.
Thanks,Raghav

View solution in original post

0 Karma

Motivator

Time is in epoch. use strftime command with %m-%d-%y %H:%M:%S as argument.

Example: Let's say the field xyz has the values 1418968800, 1419055200 etc..

use ....|eval Time = strftime(xyz,"%m-%d-%y %H:%M:%S"). Also, with 6 and above versions of Splunk, you have the license monitor embedded which should give you searches to tweak as per your needs.
Hope this helps.
Thanks,Raghav

View solution in original post

0 Karma

Communicator

This didn't work exactly but it pointed me in the right direction. Thanks!

Used |fieldformat day = strftime(day, "%b %d, %Y")

dm_license_summary_10m_by_pool | bucket _time as day span=d | eval gb=mb/1024 | stats sum(gb) as gb by pool, day | eval gb=round(gb,2) | fieldformat day = strftime(day, "%b %d, %Y")

0 Karma