Splunk Enterprise Security

Merge to 2 searches to get License usage by Application

siddh01r
New Member

HI all,

I have got a sufficient search to get license usage for the index that used by our Dev team. See below
Search -

index=_internal (idx=dev1 OR idx=dev2 OR idx=dev3) source=license_usage.log type="Usage" splunk_server= earliest=-1mon@mon@w
| eval Date=strftime(_time, "%Y/%m/%d")
| eventstats sum(b) as volume by idx, Date
| eval MB=round(volume/1024/1024,2)
| eval GB=round(volume/1024/1024/1024,2)
| timechart first(GB) AS volume by idx

However, I need it to be split by applications so 'data volume by index(dev1, dev2,dev3) by day by application name for the past month', but the applications field isnt available under_internal. I have found a search that has the information but not really sure how to merge it.

index=dev1 OR index=dev2 OR index=dev3 Properties.ApplicationName="*"

Any help would be greatful!

Thanks

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...