Hourly License Usage

[rrjcraft]

How would you go about retrieving the License Usage by Hour in GB?

[yannK]

Per hour, use timechart

index=_internal source=*license_usage.log* type=Usage
| timechart span=1h sum(b) as bytes
| eval GB = round(bytes/1024/1024/1024,5)
| fields _time GB


or use a bucketing per hour with stats

index=_internal source=*license_usage.log* type=Usage
| bucket _time span=1h
| stats sum(b) as bytes by _time
| eval GB = round(bytes/1024/1024/1024,5)
| fields _time GB


[yannK]

This is the bucket command, that regroup events based on a field, and normalize them.
see http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Bucket

If you use for the _time, it will replace all the _time by the first value of the span, here every events of the hour will have the same timestamp, the first second of the hour.

[rrjcraft]

I'm not sure what the bucketing means

[lukejadamec]

Run this search for whatever timeframe you like - it does not count all indexed data, just the data that counts against your license:

index=_internal source=*license_usage.log type=Usage 
| stats sum(b) as bytes 
| eval GB = round(bytes/1024/1024/1024,5)
| fields GB

In chart form:

index=_internal source=*license_usage.log type=Usage 
| stats sum(b) as bytes by date_hour 
| eval GB = round(bytes/1024/1024/1024,5) 
| table date_hour,GB

You will need to specify the timerange. Switch from table to chart with the chart button in the upper left.

[lukejadamec]

Use the time picker to select what time frame to check. Last 60 minutes will give you the last hour. Today will give you the amount indexed today.

Standby and I'll update the search to give an hourly chart.

[rrjcraft]

That is the tricky part. How would you go about having it display per hour? That query appears to calculate GB for all time.