Installation

Is this search accurate to measure how much data a search used in the past week?

daniel333
Builder

I have an event that is using X amount of space.

The search is:

index=network default send string

I'd like to search how many gigs of license this event is using over the last week. Anyway to do that with a search?

Labels (2)
0 Karma

hardikJsheth
Motivator

In case you want to search license usage by index, you can use following query. Replace the $index$ with the name of the index for which you want to find size.

index=_internal source=*license_usage.log* type=Usage pool="auto_generated_pool_enterprise" idx=$Index$ | eval UsageGB=b/1024/1024/1024 | timechart eval(round(sum(UsageGB),0)) as UG
0 Karma

daniel333
Builder

tried this, seem right?

index=* default send string
| eval b=len(_raw)
| stats sum(b) as mytotal
| eval mytotal = mytotal/1024/1024/2014

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...