Installation

How do you calculate the daily indexed events or volume on search head, not on license master?

appleman
Contributor

Hello.

I'd like to know how to calculate the daily indexed events and volume on search head.

When I checked the license master, it calculated only the previous month (last 30 days), but I want to know the trend in the whole year.

How do I do that?

Now about 3.8 billion events were indexed in Splunk, is it even possible to go calculate all to see the trend?

Thank you.

Labels (2)
1 Solution

strive
Influencer

Try this

index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | bucket _time span=1d | stats sum(GB) as GB_Indexed by _time

You can use i, h, s and etc.. in stats group by.

i for indexer

h for host

s for source

View solution in original post

strive
Influencer

Try this

index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | bucket _time span=1d | stats sum(GB) as GB_Indexed by _time

You can use i, h, s and etc.. in stats group by.

i for indexer

h for host

s for source

appleman
Contributor

Thank you. But the thing is, I have to run this query on license master, right?

0 Karma

appleman
Contributor

And I don't want to count index=_internal since it doesn't count as indexed volume for license.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...