Installation

Splunk license usage by host or indexes top 10

mintughosh
Path Finder

I have wrote a query to find out the license usage by host. But I need to find out the top 10 hosts or indexes in terms of license usage. I have written the following query.

index=_internal source="*license_usage.log" | stats sum(b) as bytes by h | eval MB = round(bytes/1024/1024,1) | rename h as "HOSTNAME" | fields - bytes | rename MB as "License Consumption (MB)"

The above query gives me license usage of all the hosts. I need to find top 10 hosts or indexes.

Tags (1)
0 Karma
1 Solution

dineshraj9
Builder

Sort by consumption and use the top 10 values -

index=_internal source="*license_usage.log" | stats sum(b) as bytes by h | eval MB = round(bytes/1024/1024,1) | rename h as "HOSTNAME" | fields - bytes | rename MB as "License Consumption (MB)" | sort 10 - "License Consumption (MB)"

View solution in original post

0 Karma

mwong
Splunk Employee
Splunk Employee

You can also use "top" command to show the most usage host. Please refer to our below documentation.

https://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Top

0 Karma

dineshraj9
Builder

Sort by consumption and use the top 10 values -

index=_internal source="*license_usage.log" | stats sum(b) as bytes by h | eval MB = round(bytes/1024/1024,1) | rename h as "HOSTNAME" | fields - bytes | rename MB as "License Consumption (MB)" | sort 10 - "License Consumption (MB)"
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...