Need query to get % lic usage each day for the last 30 days

[brent_weaver]

This cannot be that hard... What am I missing 🙂

I need to be able to report our % lic usage per day for the last 30 days. Any help is MUCH appreciated!

[sbbadri]

@brent_weaver

try this below query,

index=_internal source=*license_usage.log type=usage earliest=-30d@d latest=@d | eval GB = round(b/1024/1024/1024,5) | timechart span=1d sum(GB) AS "Total GB used" | join type=outer _time [search index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d latest=@d | bin _time span=1d | stats latest(stacksz) AS "stack_size" by _time] | eval stack_size = round(stack_size/1024/1024/1024,5)

or

index=_internal source=*license_usage.log type="Usage" earliest=-30d@d latest=@d | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | eval b=b/1024/1024/1024 | stats sum(b) as b by _time, pool, s, st, h, idx | timechart span=1d sum(b) AS volumeB by idx fixedrange=false | addtotals | join type=outer _time [search index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d latest=@d | bin _time span=1d | stats latest(stacksz) AS "stack_size" by _time] | eval stack_size = round(stack_size/1024/1024/1024,5)

[brent_weaver]

Thank you for these. How do I jst get the GB used? I would also like to have %lic consumption field.

Thanks!

[sbbadri]

index=_internal source=license_usage.log type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b latest(stacksz) AS stacksz by slave, pool, _time | stats sum(b) AS volumeB max(stacksz) AS stacksz by _time | eval pctused=round(volumeB/stacksz*100,2) | timechart span=1d max(pctused) AS "% used" fixedrange=false

[brent_weaver]

Hey thanks for the reply! It gives me this query:

index=_internal [`set_local_host`] source=*license_usage.log* type="RolloverSummary" earliest=-30d@d   | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b latest(stacksz) AS stacksz by slave, pool, _time | stats sum(b) AS volumeB max(stacksz) AS stacksz by _time | eval pctused=round(volumeB/stacksz*100,2) | timechart span=1d max(pctused) AS "% used" fixedrange=false

Which returns zero results. But this will at least give me what I am shooting for as a baseline.

[cpetterborg]

Go to the web interface of your license master. Settings -> Licensing -> Usage report -> Previous 30 days. You can find the searches in the dashboard panels there.