Monitoring Splunk

License Consumption Report Breakdown

shocko
Contributor

 I have Splunk 8.0.5:

  • One cluster master
  • One Search head
  • Two indexers to host clustered indexes

I would like to create a weekly report showing:

  1. License consumption per index, host, source, sourcetype
  2. License consumption per index and thereafter broken down per host, source, sourcetype

Is there already some canned report for this (licensing dashboard?) or would anyone have a custom query?

Labels (2)
0 Karma
1 Solution

saravanan90
Contributor

1. Query to get the license usage per day for index(idx), source(s), sourcetype(st) , host(h) can be pulled from license_usage file. Use the values mentioned in brackets in the timechart.

For each index:

index=_internal host=licenseserver source="*license_usage.log" type=usage idx="*" | eval MB = round(b/1048576,2) | eval st_idx = idx | timechart span=1d sum(MB) by idx limit=0  

2. To further drilldown. We can use the below query but this will calculate by going through each events.

index=* | eval esize=len(_raw) | stats sum(esize) as size by index host source sourcetype | eval size_in_GB=(size/1024/1024/1024)

View solution in original post

saravanan90
Contributor

1. Query to get the license usage per day for index(idx), source(s), sourcetype(st) , host(h) can be pulled from license_usage file. Use the values mentioned in brackets in the timechart.

For each index:

index=_internal host=licenseserver source="*license_usage.log" type=usage idx="*" | eval MB = round(b/1048576,2) | eval st_idx = idx | timechart span=1d sum(MB) by idx limit=0  

2. To further drilldown. We can use the below query but this will calculate by going through each events.

index=* | eval esize=len(_raw) | stats sum(esize) as size by index host source sourcetype | eval size_in_GB=(size/1024/1024/1024)

shocko
Contributor

Thanks for the reply! Just what I needed and much appreciated. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you looked at the Monitoring Console?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...