I got a request to create report for License Usage by Indexer Server and Top 10 Host usage per Indexer Server. Could you please help me with search query so that I can achieve that request.
They need a report which says per day how much MB/GB License being utilized per Indexer server
And For each Indexer servers what are the top 10 host's contributing
Thanks in advance!
Here's the answer to your first question:
index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d pool=* | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | eval mb = round(b/1024/1024,2) | join type=left slave [| rest count=0 /services/licenser/slaves | rename label as slave_name | rename title as slave | table slave_name slave] | search mb!=0 | timechart span=1d sum(mb) AS "volume" fixedrange=false by slave_name
You should be able to manipulate the above to get the second question as well.
Hope this helps
Search operation 'rest' is unknown. You might not have permission to run this operation.