Monitoring Splunk

License usage for last 30 days by day per hour

splunk_kk
Path Finder

Hello everyone,

I'm creating a search to calculate the license usage in last 30 days by day per hour. What table I want is attached as a picture

alt text

The search I tried is the one mentioned below. but I'm definitely missing the points here.

earliest-@d-30d latest=@d-1s index=_internal source=license_usage.log type=Usage | timechart span=1h sum(b) as bytes by date_mday | eval MB=round(byte/1024/1024,2) | fields _time date_mday MB

Thanks in advance

0 Karma

niketn
Legend

@splunk_kk, try the following based on Splunk's Licence Monitoring Query

index=_internal 
    [ `set_local_host`] source=*license_usage.log* type="RolloverSummary" earliest=-30d@d 
| bin _time span=1h 
| stats latest(b) AS b by slave, pool, _time 
| eval Date="Date:".strftime(_time,"%Y/%m/%d") 
| eval Time=strftime(_time,"%H").":00" 
| chart sum(b) AS "volume" by Time Date fixedrange=false limit=31 useother=f
| fields - _timediff 
| foreach "Date:*" 
    [ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] 
| rename "Date:*" as "*"

PS: The macro set_local_host is defined in Search App hence in order to use this outside of Search App you would need to use the underlying query instead or make the macro global.... ie. use the following instead of [set_local_host]

[rest splunk_server=local /services/server/info | return host]
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...