Installation

How to find license usage by indexes?

Communicator

Hi,

I have made one search for finding the license usages for indexes that is given below.

index=_internal source=*license_usage.log type=usage (idx=*) | eval MB = round(b/1048576,2) | eval st_idx = st.": ".idx | timechart span=1d sum(MB) by st_idx | addtotals

Now the issue is if I pass through any index name to idx parameter, then it is giving result for the particular index, but when I am using * for enlisting all indexes, then it is giving "no result found".

Please give suggestions and help me to sort out this issue.

Thanks in advance...

Labels (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Able to see result for both

index=_internal source="*license_usage.log" type=usage idx="*" | eval MB = round(b/1048576,2) | eval st_idx = st.": ".idx | timechart span=1d sum(MB) by st_idx | addtotals

And

index=_internal source="*license_usage.log" type=usage idx="windows" | eval MB = round(b/1048576,2) | eval st_idx = st.": ".idx | timechart span=1d sum(MB) by st_idx | addtotals

If the above is not working for you, can you check job inspector and see what's the final search when you replace idx=*

View solution in original post

SplunkTrust
SplunkTrust

Able to see result for both

index=_internal source="*license_usage.log" type=usage idx="*" | eval MB = round(b/1048576,2) | eval st_idx = st.": ".idx | timechart span=1d sum(MB) by st_idx | addtotals

And

index=_internal source="*license_usage.log" type=usage idx="windows" | eval MB = round(b/1048576,2) | eval st_idx = st.": ".idx | timechart span=1d sum(MB) by st_idx | addtotals

If the above is not working for you, can you check job inspector and see what's the final search when you replace idx=*

View solution in original post

Than you for the answer !

This is strange, there is a difference between the total and the DMC :

SH query : 925 GB
DMC : 909 GB

0 Karma