Installation
Highlighted

Hourly License Usage

Explorer

How would you go about retrieving the License Usage by Hour in GB?

Tags (5)
Highlighted

Re: Hourly License Usage

Super Champion

Run this search for whatever timeframe you like - it does not count all indexed data, just the data that counts against your license:

index=_internal source=*license_usage.log type=Usage 
| stats sum(b) as bytes 
| eval GB = round(bytes/1024/1024/1024,5)
| fields GB

In chart form:

index=_internal source=*license_usage.log type=Usage 
| stats sum(b) as bytes by date_hour 
| eval GB = round(bytes/1024/1024/1024,5) 
| table date_hour,GB

You will need to specify the timerange. Switch from table to chart with the chart button in the upper left.

0 Karma
Highlighted

Re: Hourly License Usage

Explorer

That is the tricky part. How would you go about having it display per hour? That query appears to calculate GB for all time.

0 Karma
Highlighted

Re: Hourly License Usage

Super Champion

Use the time picker to select what time frame to check. Last 60 minutes will give you the last hour. Today will give you the amount indexed today.

Standby and I'll update the search to give an hourly chart.

0 Karma
Highlighted

Re: Hourly License Usage

Splunk Employee
Splunk Employee

Per hour, use timechart

index=_internal source=*license_usage.log* type=Usage
| timechart span=1h sum(b) as bytes
| eval GB = round(bytes/1024/1024/1024,5)
| fields _time GB

or use a bucketing per hour with stats

index=_internal source=*license_usage.log* type=Usage
| bucket _time span=1h
| stats sum(b) as bytes by _time
| eval GB = round(bytes/1024/1024/1024,5)
| fields _time GB

Highlighted

Re: Hourly License Usage

Explorer

I'm not sure what the bucketing means

0 Karma
Highlighted

Re: Hourly License Usage

Splunk Employee
Splunk Employee

This is the bucket command, that regroup events based on a field, and normalize them.
see http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Bucket

If you use for the _time, it will replace all the _time by the first value of the span, here every events of the hour will have the same timestamp, the first second of the hour.

0 Karma