I am trying to calculate the license used by one of my index which is not in use now (meaning we stopped sending data to this index as it was consuming too much license just a week ago, so the previous logs are still present in the bucket). now we want to know how much license it was consuming earlier with a breakdown of host and source.
I tried checking the _internal index for the license usage using below query. I am able to get the results for other existing index but not this one I am looking for.
index=internal source=*licenseusage.log type="Usage" splunkserver=* idx=aom | eval Date=strftime(time, "%Y/%m/%d") | eventstats sum(b) as volume by idx, Date | eval MB=round(volume/1024/1024,5)| timechart first(MB) AS volume by idx
can some one tell me how to do this.
Thanks in advance
hey try this you will get info about each index
index=_internal [ `set_local_host`] source=*license_usage.log* type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st, h, idx | timechart span=1d sum(b) AS volumeB by idx fixedrange=false | join type=outer _time [ search index=_internal [ `set_local_host`] source=*license_usage.log* type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(stacksz) AS "stack size" by _time] | fields - _timediff | foreach * [ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]
You can find the same in
Licensing>>Usage Report >>Last 30 days>>by index
If you want to stick to your query then try
idx=* to look for each index.
let me know if this helps!