Splunk Search

Calculating Splunk License Usage Based on a condition

anandhalagaras1
Path Finder

Hi Team,

I am aware that we can able to pull the license usage stats in splunk for index, host and sourcetype for a day. But whereas I want to pull the license usage stats in GB for last 30 days.

I have two requirement seperately to pull the exact license usage stats for last 30 days in Splunk.

1.)The first one would be based on the app and severity of how much logs are ingested in GB for last 30 days for both the index.

index=abc OR index=xyz app IN (splunk,"Splunk-Daemon") severity=informational

================================================================================

2.) The second condition would be based on a index for two sourcetypes with a particular keyword. 

2.) index=abc sourcetype IN ("efg","ijk") "www.splunk.com*"

 

So for each requirement how can I be able to pull the license usage in Splunk for last 30 days. Kindly help on the same.

Labels (1)
0 Karma

anandhalagaras1
Path Finder

Hi Team,

 

Can anyone help on my query please.

0 Karma

anandhalagaras1
Path Finder

Can anyone help on my query please.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!