Getting Data In

Splunk Host problem

alaquerre
Explorer

Hi ,

I currently have a problem with my reporting host. I am trying to solve a license violation issue but cannot find the search command in order to view the top reporting host based on how much space it is taking in mb.

When I look up by host, I only get one host instead of 35. It is as if splunk has declared my 35 agents as being reporting host instead of hosts.

Any help on this would be greatly apprecaited

Tags (2)
1 Solution

jtrucks
Splunk Employee
Splunk Employee

Use this:

index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | bucket _time span=1d | stats sum(GB) by _time,h

Enjoy!

--
Jesse Trucks
Minister of Magic

View solution in original post

jtrucks
Splunk Employee
Splunk Employee

Use this:

index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | bucket _time span=1d | stats sum(GB) by _time,h

Enjoy!

--
Jesse Trucks
Minister of Magic

alaquerre
Explorer

Thank you very much for your answer, however what I get as a result is the time the Sum(Gb) and what appears in the H column is my Splunk Server. IT as if splunk sees my splunk server as a host and then all the rest of my ossec agents as reporting_host.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...