I got a request to create report for License Usage by Indexer Server and Top 10 Host usage per Indexer Server. Could you please help me with search query so that I can achieve that request.
They need a report which says per day how much MB/GB License being utilized per Indexer server
And For each Indexer servers what are the top 10 host's contributing
Thanks in advance!
Here's the answer to your first question:
index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d pool=* | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | eval mb = round(b/1024/1024,2) | join type=left slave [| rest count=0 /services/licenser/slaves | rename label as slave_name | rename title as slave | table slave_name slave] | search mb!=0 | timechart span=1d sum(mb) AS "volume" fixedrange=false by slave_name
You should be able to manipulate the above to get the second question as well.
Hope this helps