Getting Data In

Splunk Host problem

Explorer

Hi ,

I currently have a problem with my reporting host. I am trying to solve a license violation issue but cannot find the search command in order to view the top reporting host based on how much space it is taking in mb.

When I look up by host, I only get one host instead of 35. It is as if splunk has declared my 35 agents as being reporting host instead of hosts.

Any help on this would be greatly apprecaited

Tags (2)
1 Solution

Splunk Employee
Splunk Employee

Use this:

index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | bucket _time span=1d | stats sum(GB) by _time,h

Enjoy!

View solution in original post

Splunk Employee
Splunk Employee

Use this:

index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | bucket _time span=1d | stats sum(GB) by _time,h

Enjoy!

View solution in original post

Explorer

Thank you very much for your answer, however what I get as a result is the time the Sum(Gb) and what appears in the H column is my Splunk Server. IT as if splunk sees my splunk server as a host and then all the rest of my ossec agents as reporting_host.

0 Karma