License Usage of previously indexed data

[Navanitha]

Hi,

I am trying to calculate the license used by one of my index which is not in use now (meaning we stopped sending data to this index as it was consuming too much license just a week ago, so the previous logs are still present in the bucket). now we want to know how much license it was consuming earlier with a breakdown of host and source.

I tried checking the _internal index for the license usage using below query. I am able to get the results for other existing index but not this one I am looking for.

index=_internal source=license_usage.log type="Usage" splunk_server= idx=aom | eval Date=strftime(_time, "%Y/%m/%d") | eventstats sum(b) as volume by idx, Date | eval MB=round(volume/1024/1024,5)| timechart first(MB) AS volume by idx

can some one tell me how to do this.

Thanks in advance

[mayurr98]

hey try this you will get info about each index

index=_internal 
    [ `set_local_host`] source=*license_usage.log* type="Usage" 
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) 
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) 
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
| bin _time span=1d 
| stats sum(b) as b by _time, pool, s, st, h, idx 
| timechart span=1d sum(b) AS volumeB by idx fixedrange=false 
| join type=outer _time 
    [ search index=_internal 
        [ `set_local_host`] source=*license_usage.log* type="RolloverSummary" earliest=-30d@d 
    | eval _time=_time - 43200 
    | bin _time span=1d 
    | stats latest(stacksz) AS "stack size" by _time] 
| fields - _timediff 
| foreach * 
    [ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]

You can find the same in Licensing>>Usage Report >>Last 30 days>>by index
If you want to stick to your query then try idx=* to look for each index.
let me know if this helps!

[Navanitha]

Hi Mayur, thanks for the query. I tried running it but no results found.

[splforfun]

Make sure that you either set or remove this macro from both search stanzas. 

[ `set_local_host`]