Reporting

license report for specific sourcetypes for a specific time period

a212830
Champion

Hi,

How can I generate a report on license usage for a couple of specific sourcetypes for certain time-periods? I'm using Splunk 6.1.

Tags (3)
0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

index=_internal earliest=-1w latest=now source=license_usage.log type=Usage
| eval s=if(s=="","unknown",s)
| eval h=if(h=="","unknown",h)
| stats sum(b) AS volume_b by st
| eval volume_g=volume_b/1024/1024
| rename st as SourceType
| fields - volume_b
| sort - volume_g

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

That is odd since it works fine for me. Is this a single server install? https://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume

0 Karma

a212830
Champion

Thanks. It came back with no data. Tried it on 2 different systems.

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Download the SoS app. It should have all the license metrics for you. You will also need the sideview utils app.

0 Karma

a212830
Champion

Sos has detected that you are running Splunk 6..go to license manager page.

That lists everything, without the ability to drill-down. Is there an available search?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!