How to search license usage by indexer server and top 10 host usage per indexer?

[kpavan]

Hi All,

I got a request to create report for License Usage by Indexer Server and Top 10 Host usage per Indexer Server. Could you please help me with search query so that I can achieve that request.

They need a report which says per day how much MB/GB License being utilized per Indexer server
And For each Indexer servers what are the top 10 host's contributing

Thanks in advance!

[aholzer]

Here's the answer to your first question:

index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d pool=* | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | eval mb = round(b/1024/1024,2)
| join type=left slave 
     [| rest count=0 /services/licenser/slaves 
     | rename label as slave_name
     | rename title as slave 
     | table slave_name slave]
| search mb!=0
| timechart span=1d sum(mb) AS "volume" fixedrange=false by slave_name

You should be able to manipulate the above to get the second question as well.

Hope this helps

[sspomeplus]

Search operation 'rest' is unknown. You might not have permission to run this operation.

Any suggestion?

[somesoni2]

There was a pipe symbol missing in the rest subsearch. Try now.

[sspomeplus]

10x.

But in our case it's not working because the splunk version is < 5.
Any suggestion?