Splunk Enterprise Security

Merge to 2 searches to get License usage by Application

New Member

HI all,

I have got a sufficient search to get license usage for the index that used by our Dev team. See below
Search -

index=_internal (idx=dev1 OR idx=dev2 OR idx=dev3) source=license_usage.log type="Usage" splunk_server= earliest=-1mon@mon@w
| eval Date=strftime(_time, "%Y/%m/%d")
| eventstats sum(b) as volume by idx, Date
| eval MB=round(volume/1024/1024,2)
| eval GB=round(volume/1024/1024/1024,2)
| timechart first(GB) AS volume by idx

However, I need it to be split by applications so 'data volume by index(dev1, dev2,dev3) by day by application name for the past month', but the applications field isnt available under_internal. I have found a search that has the information but not really sure how to merge it.

index=dev1 OR index=dev2 OR index=dev3 Properties.ApplicationName="*"

Any help would be greatful!


0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...