Getting Data In

How to search license usage by indexer server and top 10 host usage per indexer?

kpavan
Path Finder

Hi All,

I got a request to create report for License Usage by Indexer Server and Top 10 Host usage per Indexer Server. Could you please help me with search query so that I can achieve that request.

They need a report which says per day how much MB/GB License being utilized per Indexer server
And For each Indexer servers what are the top 10 host's contributing

Thanks in advance!

0 Karma

aholzer
Motivator

Here's the answer to your first question:

index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d pool=* | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | eval mb = round(b/1024/1024,2)
| join type=left slave 
     [| rest count=0 /services/licenser/slaves 
     | rename label as slave_name
     | rename title as slave 
     | table slave_name slave]
| search mb!=0
| timechart span=1d sum(mb) AS "volume" fixedrange=false by slave_name

You should be able to manipulate the above to get the second question as well.

Hope this helps

sspomeplus
New Member

Search operation 'rest' is unknown. You might not have permission to run this operation.

Any suggestion?

0 Karma

somesoni2
Revered Legend

There was a pipe symbol missing in the rest subsearch. Try now.

0 Karma

sspomeplus
New Member

10x.

But in our case it's not working because the splunk version is < 5.
Any suggestion?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...