search license usage with threshold

[oliverrojo]

Hi,

I am trying to search for hosts with license usage above 5GB but my search parameter is still showing hosts with usage below 5GB. Please help.

index=_internal source="*license_usage.log" h!="idm-*" h!="ip-*" | stats sum(b) as bytes by h | eval GB = round(bytes/1024/1024/1024,1) | rename h as "HOSTNAME" | fields - bytes | sort 30 - G where GB > 5

Looks like "where GB > 5"  after the sort isn't working here. 

[aasabatini]

Hi @oliverrojo 

your search should works but you miss a pipe before the where condition

index=_internal source="*license_usage.log" h!="idm-*" h!="ip-*" | stats sum(b) as bytes by h | eval GB = round(bytes/1024/1024/1024,1) | rename h as "HOSTNAME" | fields - bytes | sort 30 - G | where GB > 5

[oliverrojo]

hi aasabatini,

I figured it out... i set my search params below... thanks for your advise!

index=_internal source="*license_usage.log" h!="idm-*" h!="ip-*" h!="" h!="UTC*" | stats sum(b) as bytes by h | eval GB = round(bytes/1024/1024/1024,1) | rename h as "HOSTNAME" | fields - bytes | where GB>2 | sort 30 -GB