Getting Data In

How to search license usage by indexer server and top 10 host usage per indexer?

Path Finder

Hi All,

I got a request to create report for License Usage by Indexer Server and Top 10 Host usage per Indexer Server. Could you please help me with search query so that I can achieve that request.

They need a report which says per day how much MB/GB License being utilized per Indexer server
And For each Indexer servers what are the top 10 host's contributing

Thanks in advance!

0 Karma


Here's the answer to your first question:

index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d pool=* | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | eval mb = round(b/1024/1024,2)
| join type=left slave 
     [| rest count=0 /services/licenser/slaves 
     | rename label as slave_name
     | rename title as slave 
     | table slave_name slave]
| search mb!=0
| timechart span=1d sum(mb) AS "volume" fixedrange=false by slave_name

You should be able to manipulate the above to get the second question as well.

Hope this helps

New Member

Search operation 'rest' is unknown. You might not have permission to run this operation.

Any suggestion?

0 Karma

Revered Legend

There was a pipe symbol missing in the rest subsearch. Try now.

0 Karma

New Member


But in our case it's not working because the splunk version is < 5.
Any suggestion?

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...