Splunk Host problem

[alaquerre]

Hi ,

I currently have a problem with my reporting host. I am trying to solve a license violation issue but cannot find the search command in order to view the top reporting host based on how much space it is taking in mb.

When I look up by host, I only get one host instead of 35. It is as if splunk has declared my 35 agents as being reporting host instead of hosts.

Any help on this would be greatly apprecaited

[jtrucks · Accepted solution]

Use this:

index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | bucket _time span=1d | stats sum(GB) by _time,h

Enjoy!

[alaquerre]

Thank you very much for your answer, however what I get as a result is the time the Sum(Gb) and what appears in the H column is my Splunk Server. IT as if splunk sees my splunk server as a host and then all the rest of my ossec agents as reporting_host.