Getting Data In

How to get a license report with sourcetypes and indexes?

a212830
Champion

Hi,

I need a license report for sourcetypes that also shows the relevant index. Is that possible?

0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Try this:

index=_internal source=*license_usage.log type="Usage" 
| eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| eval sourcetypename = st
| bin _time span=1d 
| stats sum(b) as b by _time, pool, indexname, sourcetypename
| eval GB=round(b/1024/1024/1024, 3)
| fields _time, indexname, sourcetypename, GB

View solution in original post

javiergn
SplunkTrust
SplunkTrust

Try this:

index=_internal source=*license_usage.log type="Usage" 
| eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| eval sourcetypename = st
| bin _time span=1d 
| stats sum(b) as b by _time, pool, indexname, sourcetypename
| eval GB=round(b/1024/1024/1024, 3)
| fields _time, indexname, sourcetypename, GB

View solution in original post

sloshburch
Ultra Champion

For posterity, the newer versions (6+?) of splunk include fields for the index, host, source, and sourcetype in the license_usage.log file. They are i,h,s,st, respectively (I believe).

0 Karma

a212830
Champion

Fantastic! Thanks.

And of course, now I'm being asked to include host. Is that possible?

0 Karma

a212830
Champion

Never mind. figured it out. Thanks.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!