Is there away to find the exact hostname from the (SQUASHED) details in Splunk?

[Hemnaath]

Hi All,

We are finding it very hard to calculate the license usage details by each host, I had executed the below query which I had got from one of the post in answers.com based on the query, we are able to see the license usage details per sourcetype and per hostname for a particular index, but difficult part is that in hostname field value we are seeing (SQUASHED) as value and that is consuming more license, so could anyone guide me on how to find the exact hostname details from the (SQUASHED) output.

index=_internal source=*license_usage.log* type="Usage" idx="XXX"
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
| eval st=if(len(st)=0 OR isnull(st),"(UNKNOWN)",st)
| fields _time,b,h,st
| bin _time span=1d
| stats sum(b) AS volume by h, _time,st
| stats avg(volume) AS avgVolume max(volume) AS maxVolume by h,st
| eval avgVolumeGB=round(avgVolume/1024/1024/1024,3)
| eval maxVolumeGB=round(maxVolume/1024/1024/1024,3)
| fields h,st, avgVolumeGB, maxVolumeGB
| rename avgVolumeGB AS "average" maxVolumeGB AS "peak",st AS "sourcetype", h AS "hostname"
| sort - average
| head 10

Output 

hostname                             Sourcetype                                      average       peak 

(SQUASHED)                       test:test1:cisco                               175.934    409.272

Problem statement: how to find the exact hostname details from the (SQUASHED) output.

[isoutamo]

Hi

I'm afraiding that there is nothing to do to avoid it. You could decrease those, but probably don't get over all of them.

• https://community.splunk.com/t5/All-Apps-and-Add-ons/Accurate-License-usage-when-data-is-SQUASHED-pe...
• Squashing fields

r. Ismo