Installation

How to resolve mismatch in daily license usage vs. actual utilization?

Communicator

I have run searches for data coming through all of the forwarders and matched it with actual daily license utilization.

Two of the searches are,

  1. index=internal group=* group=perhostthruput | bucket _time span=1d|bin _time |eval time=strftime(time,"%m/%d/%y") | eval kb=(kb/1024/1024) | stats sum(kb) as SUM by time series | xyseries series time SUM |sort -SUM
  2. index="internal" source="*metrics.log" group="perhost_thruput" | chart sum(kb) by series | sort - sum(kb)

It's weird that results of the searches are showing far greater than the actual utilization. Ran it for today accounting all forwarders & the sum shows almost 500GB of data whereas license utilization is 280+Gigs only.

Is the search I am inputting incorrect, or is there something else I'm missing?

Labels (1)
0 Karma
1 Solution

Communicator

Hi @splunker12er, tried your's query but the only host it is showing is license master itself not any other.

However try this query, it gives exact license usage per host along with index, source and sourcetype.

index=internal [`setlocalhost`] source=*licenseusage.log* type="Usage"
2. | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
3. | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
4. | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
5. |dedup time host i b s st h idx
6. | bin _time span=1d
7. | stats sum(b) as b values(s) As Source values(st) As sourceType values(idx) As Index values(
time) As Time by h
8. | eval rGB=b/1024/1024/1024 | convert ctime(Time) timeformat="%m/%d%Y %H:%M:%S %z"
9. |sort -r
GB

Enjoy!!

View solution in original post

Communicator

Hi @splunker12er, tried your's query but the only host it is showing is license master itself not any other.

However try this query, it gives exact license usage per host along with index, source and sourcetype.

index=internal [`setlocalhost`] source=*licenseusage.log* type="Usage"
2. | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
3. | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
4. | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
5. |dedup time host i b s st h idx
6. | bin _time span=1d
7. | stats sum(b) as b values(s) As Source values(st) As sourceType values(idx) As Index values(
time) As Time by h
8. | eval rGB=b/1024/1024/1024 | convert ctime(Time) timeformat="%m/%d%Y %H:%M:%S %z"
9. |sort -r
GB

Enjoy!!

View solution in original post

Motivator

Try this query on license master, this gives correct license usage stats per host

index=_internal source=*license_usage.log* type=Usage 
    |  bucket _time span=1d 
    |  stats sum(b) AS volume_bytes by _time host pool i 
    | eval volume_GB=round(volume_bytes/1024/1024/1024,2) 
    | rename i AS indexer_GUID 
    | JOIN indexer_GUID [ | REST /services/licenser/slaves | table title label | rename title AS indexer_GUID| rename label AS indexer_name] 
0 Karma