I was wondering, since I am new to Splunk, what kind of search would I use to search for a specific license pool usage and the hosts/sources that are providing data to that pool.
We currently have 5 different pools, but all the data is going to same 3 indexers. We have Enterprise Security which is the main license pool and we are trying to isolate the amount of data being ingested by that pool and the sources that feed that pool as well.
I think this is what I am looking for but I also want a total at the bottom
index=_internal source="*license_usage.lo*" type=Usage pool=auto_generated_pool_enterprise | dedup h | stats sum(b) as bytes by h | eval mb=bytes/1048576
any help with that?
Maybe this is better
index=_internal source="*license_usage.lo*" type=Usage pool=auto_generated_pool_enterprise | dedup h | rename h as Host | stats sum(b) as bytes by Host | eval mb=bytes/1048576 |addcoltotals|fillnull value="Total" mb
Please let me know what you think or how to make it look nicer