Hi,
I need a license report for sourcetypes that also shows the relevant index. Is that possible?
Try this:
index=_internal source=*license_usage.log type="Usage"
| eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| eval sourcetypename = st
| bin _time span=1d
| stats sum(b) as b by _time, pool, indexname, sourcetypename
| eval GB=round(b/1024/1024/1024, 3)
| fields _time, indexname, sourcetypename, GB
Try this:
index=_internal source=*license_usage.log type="Usage"
| eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| eval sourcetypename = st
| bin _time span=1d
| stats sum(b) as b by _time, pool, indexname, sourcetypename
| eval GB=round(b/1024/1024/1024, 3)
| fields _time, indexname, sourcetypename, GB
For posterity, the newer versions (6+?) of splunk include fields for the index, host, source, and sourcetype in the license_usage.log file. They are i,h,s,st, respectively (I believe).
Fantastic! Thanks.
And of course, now I'm being asked to include host. Is that possible?
Never mind. figured it out. Thanks.