Getting Data In

How to get a license report with sourcetypes and indexes?

Champion

Hi,

I need a license report for sourcetypes that also shows the relevant index. Is that possible?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this:

index=_internal source=*license_usage.log type="Usage" 
| eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| eval sourcetypename = st
| bin _time span=1d 
| stats sum(b) as b by _time, pool, indexname, sourcetypename
| eval GB=round(b/1024/1024/1024, 3)
| fields _time, indexname, sourcetypename, GB

View solution in original post

SplunkTrust
SplunkTrust

Try this:

index=_internal source=*license_usage.log type="Usage" 
| eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| eval sourcetypename = st
| bin _time span=1d 
| stats sum(b) as b by _time, pool, indexname, sourcetypename
| eval GB=round(b/1024/1024/1024, 3)
| fields _time, indexname, sourcetypename, GB

View solution in original post

Ultra Champion

For posterity, the newer versions (6+?) of splunk include fields for the index, host, source, and sourcetype in the license_usage.log file. They are i,h,s,st, respectively (I believe).

0 Karma

Champion

Fantastic! Thanks.

And of course, now I'm being asked to include host. Is that possible?

0 Karma

Champion

Never mind. figured it out. Thanks.

0 Karma