Getting Data In

How to get a license report with sourcetypes and indexes?

a212830
Champion

Hi,

I need a license report for sourcetypes that also shows the relevant index. Is that possible?

0 Karma
1 Solution

javiergn
Super Champion

Try this:

index=_internal source=*license_usage.log type="Usage" 
| eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| eval sourcetypename = st
| bin _time span=1d 
| stats sum(b) as b by _time, pool, indexname, sourcetypename
| eval GB=round(b/1024/1024/1024, 3)
| fields _time, indexname, sourcetypename, GB

View solution in original post

javiergn
Super Champion

Try this:

index=_internal source=*license_usage.log type="Usage" 
| eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| eval sourcetypename = st
| bin _time span=1d 
| stats sum(b) as b by _time, pool, indexname, sourcetypename
| eval GB=round(b/1024/1024/1024, 3)
| fields _time, indexname, sourcetypename, GB

sloshburch
Splunk Employee
Splunk Employee

For posterity, the newer versions (6+?) of splunk include fields for the index, host, source, and sourcetype in the license_usage.log file. They are i,h,s,st, respectively (I believe).

0 Karma

a212830
Champion

Fantastic! Thanks.

And of course, now I'm being asked to include host. Is that possible?

0 Karma

a212830
Champion

Never mind. figured it out. Thanks.

0 Karma
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...