host field in 'Host Usage - Current Day - Top 20' panels

[rchudzinski]

Hi,
This is a very nice dashboard. One comment, I notice that the 'Host Usage - Current Day - Top 20' panels are displaying the indexer name as the 'host' field. I suspect you want to use the 'h' field which is the name of the forwarding agent. At least that is where I find the most value.

So the search text would become
"index=_internal source=license_usage.log type=Usage pool= | stats sum(b) as b by h | eval "Bytes"=round(b) | rename h as Host | fields Host, "Bytes" | sort 20 - Bytes"

Warm Regards,
ray

[dwraesner]

Hello Ray,

Thanks for the thumbs up, and the comment.

I have changed the panel "Host Usage - Current Day - Top 20" so that the field "h", instead of the field "host", now shows results in the "Host" column.

Also, added the field "host" to show results in the "Indexer" column, and the field "splunk_server" to show results in the "Splunk Server" column.

From your results is the splunk_server always the Search Head?

Sorry it took so long as this was the first time I've opened the "Questions on SplunkAnswers" link.

Since your post in July have made many other changes to the License Usage Dashboard.

Best Regards,
Dennis Raesner