Monitoring Splunk

How do I view daily license usage by index?

vqd361
Path Finder

Splunk 6.1's license usage reporting will let me view my license usage by index for the last 30 days, but the graph only shows 10 indexes. The rest are presumably in the entry titled "OTHER". How do I get a report that lists all of my indexes? I opened the search for the graph and viewed it in the Statistics tab, but I still have a column called "OTHER".

Here's the search that I'm using. I don't see where it's combining indexes into "OTHER".

index=_internal source=*license_usage.log type="Usage"
 | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
 | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
 | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
 | bin _time span=1d
 | stats sum(b) as b by _time, pool, s, st, h, idx
 | timechart span=1d sum(b) AS volumeB by idx fixedrange=false
 | join type=outer _time [search index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d
 | eval _time=_time - 43200
 | bin _time span=1d
 | stats latest(stacksz) AS "stack size" by _time]
 | fields - _timediff
 | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]
 | fields - "stack size"
Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

useother=f will hide the OTHER field... instead, use limit=0 to not stop at ten values.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

useother=f will hide the OTHER field... instead, use limit=0 to not stop at ten values.

vqd361
Path Finder

Thanks. Adding limit=0 to the timechart command produced exactly the result I was looking for.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

As MuS mentioned in his comment: useother=f doc link

0 Karma

MuS
SplunkTrust
SplunkTrust

Use timechart with option useother=f

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...