Installation

Splunk license usage by host or indexes top 10

mintughosh
Path Finder

I have wrote a query to find out the license usage by host. But I need to find out the top 10 hosts or indexes in terms of license usage. I have written the following query.

index=_internal source="*license_usage.log" | stats sum(b) as bytes by h | eval MB = round(bytes/1024/1024,1) | rename h as "HOSTNAME" | fields - bytes | rename MB as "License Consumption (MB)"

The above query gives me license usage of all the hosts. I need to find top 10 hosts or indexes.

Tags (1)
0 Karma
1 Solution

dineshraj9
Builder

Sort by consumption and use the top 10 values -

index=_internal source="*license_usage.log" | stats sum(b) as bytes by h | eval MB = round(bytes/1024/1024,1) | rename h as "HOSTNAME" | fields - bytes | rename MB as "License Consumption (MB)" | sort 10 - "License Consumption (MB)"

View solution in original post

0 Karma

mwong
Splunk Employee
Splunk Employee

You can also use "top" command to show the most usage host. Please refer to our below documentation.

https://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Top

0 Karma

dineshraj9
Builder

Sort by consumption and use the top 10 values -

index=_internal source="*license_usage.log" | stats sum(b) as bytes by h | eval MB = round(bytes/1024/1024,1) | rename h as "HOSTNAME" | fields - bytes | rename MB as "License Consumption (MB)" | sort 10 - "License Consumption (MB)"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...