Getting Data In
Highlighted

How to search license usage by indexer server and top 10 host usage per indexer?

Path Finder

Hi All,

I got a request to create report for License Usage by Indexer Server and Top 10 Host usage per Indexer Server. Could you please help me with search query so that I can achieve that request.

They need a report which says per day how much MB/GB License being utilized per Indexer server
And For each Indexer servers what are the top 10 host's contributing

Thanks in advance!

0 Karma
Highlighted

Re: How to search license usage by indexer server and top 10 host usage per indexer?

Motivator

Here's the answer to your first question:

index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d pool=* | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | eval mb = round(b/1024/1024,2)
| join type=left slave 
     [| rest count=0 /services/licenser/slaves 
     | rename label as slave_name
     | rename title as slave 
     | table slave_name slave]
| search mb!=0
| timechart span=1d sum(mb) AS "volume" fixedrange=false by slave_name

You should be able to manipulate the above to get the second question as well.

Hope this helps

Highlighted

Re: How to search license usage by indexer server and top 10 host usage per indexer?

New Member

Search operation 'rest' is unknown. You might not have permission to run this operation.

Any suggestion?

0 Karma
Highlighted

Re: How to search license usage by indexer server and top 10 host usage per indexer?

SplunkTrust
SplunkTrust

There was a pipe symbol missing in the rest subsearch. Try now.

0 Karma
Highlighted

Re: How to search license usage by indexer server and top 10 host usage per indexer?

New Member

10x.

But in our case it's not working because the splunk version is < 5.
Any suggestion?

0 Karma