Monitoring Splunk

How to get license usage data for a particular index with a breakdown of usage by a field?

Path Finder

Hi,

Does anyone know how I can query the license usage of a particular index, breakdown by a field?

Basically I have an index called testindex and there is a field in each event called logtype. I would like to know, on a given date, how much indexed data there is in this index, broken down by logtype. I would expect the output to be something like:

logtype1 10G
log
type2 1.5G
log_type3 0.45G
etc.

Any help will be greatly appreciated.

Thanks.

Regards,
Jackie

1 Solution

SplunkTrust
SplunkTrust

I fear the license usage logs aren't going to be helpful here, so you may need to go brute force:

index=particular | eval length = length(_raw) | timechart span=1d sum(length) by log_type

If you're going to run this more than once it'll be a good idea to summary index the daily data.

View solution in original post

SplunkTrust
SplunkTrust

I fear the license usage logs aren't going to be helpful here, so you may need to go brute force:

index=particular | eval length = length(_raw) | timechart span=1d sum(length) by log_type

If you're going to run this more than once it'll be a good idea to summary index the daily data.

View solution in original post

SplunkTrust
SplunkTrust

Technically they are in characters. Convert before the timechart, so something like this:

... | eval length = length(_raw) / 1048576 | ...

to get the length in megacharacters.

Path Finder

Thanks Martin

0 Karma

Path Finder

Thanks a lot for the quick reply, I really appreciate it.

0 Karma

Path Finder

One quick question. The numbers returned from the query you suggested, are they in bit or byte or Mb? I want to have it set to GB, but when I changed sum(length) to sum(length/1024), it didn't work.

0 Karma