Monitoring Splunk
Highlighted

License Usage of previously indexed data

Explorer

Hi,

I am trying to calculate the license used by one of my index which is not in use now (meaning we stopped sending data to this index as it was consuming too much license just a week ago, so the previous logs are still present in the bucket). now we want to know how much license it was consuming earlier with a breakdown of host and source.

I tried checking the _internal index for the license usage using below query. I am able to get the results for other existing index but not this one I am looking for.

index=internal source=*licenseusage.log type="Usage" splunkserver=* idx=aom | eval Date=strftime(time, "%Y/%m/%d") | eventstats sum(b) as volume by idx, Date | eval MB=round(volume/1024/1024,5)| timechart first(MB) AS volume by idx

can some one tell me how to do this.

Thanks in advance

Tags (1)
0 Karma
Highlighted

Re: License Usage of previously indexed data

SplunkTrust
SplunkTrust

hey try this you will get info about each index

index=_internal 
    [ `set_local_host`] source=*license_usage.log* type="Usage" 
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) 
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) 
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
| bin _time span=1d 
| stats sum(b) as b by _time, pool, s, st, h, idx 
| timechart span=1d sum(b) AS volumeB by idx fixedrange=false 
| join type=outer _time 
    [ search index=_internal 
        [ `set_local_host`] source=*license_usage.log* type="RolloverSummary" earliest=-30d@d 
    | eval _time=_time - 43200 
    | bin _time span=1d 
    | stats latest(stacksz) AS "stack size" by _time] 
| fields - _timediff 
| foreach * 
    [ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]

You can find the same in Licensing>>Usage Report >>Last 30 days>>by index
If you want to stick to your query then try idx=* to look for each index.
let me know if this helps!

0 Karma
Highlighted

Re: License Usage of previously indexed data

Explorer

Hi Mayur, thanks for the query. I tried running it but no results found.

0 Karma