Splunk Search

Calculating Splunk License Usage Based on a condition

anandhalagaras1
Path Finder

Hi Team,

I am aware that we can able to pull the license usage stats in splunk for index, host and sourcetype for a day. But whereas I want to pull the license usage stats in GB for last 30 days.

I have two requirement seperately to pull the exact license usage stats for last 30 days in Splunk.

1.)The first one would be based on the app and severity of how much logs are ingested in GB for last 30 days for both the index.

index=abc OR index=xyz app IN (splunk,"Splunk-Daemon") severity=informational

================================================================================

2.) The second condition would be based on a index for two sourcetypes with a particular keyword. 

2.) index=abc sourcetype IN ("efg","ijk") "www.splunk.com*"

 

So for each requirement how can I be able to pull the license usage in Splunk for last 30 days. Kindly help on the same.

Labels (1)
0 Karma

anandhalagaras1
Path Finder

Hi Team,

 

Can anyone help on my query please.

0 Karma

anandhalagaras1
Path Finder

Can anyone help on my query please.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!