Splunk Enterprise

Usage for specific Host

Bisho-Fouad
Explorer

Hey there , kindly need support how to determine received logs SIZE for specific Host. Prefers to be done through GUI 

Hit: working on distributed environment also own License master instance 

 

thanks in advance, 

Labels (1)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @Bisho-Fouad .. on the DMC / license master.. you can find out the license usage of a specific host. 

pls suggest us exactly which step/status you are in.. 

 

As you are asking GUI.. the SPL gives more control actually. 

0 Karma

yeahnah
Motivator

Hi @Bisho-Fouad 

Here's an example search to solve your question...

 

host=<your host> ``` and whatever else you need to filter your data ````
| eval bytes = length(_raw)  ``` generally 1 character = 1 byte ```
| stats sum(bytes) AS bytes BY source   ``` this gives the size of each log, assuming the source is the name of the log file ```
| eval kilobytes = bytes/1024)
| evenstats sum(kilobytes) AS total_kb

 

Hope that helps

 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

If you hear someone at .conf26 shouting "gear down, GEAR DOWN" across the show floor, you have found us.  The ...

Turn Cisco Telemetry Into Action with Cisco Data Fabric, powered by the Splunk ...

The surge in machine data is already hitting enterprise budgets, and the agentic era will only intensify it. ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...