Splunk Search

Calculating Splunk License Usage Based on a condition

anandhalagaras1
Contributor

Hi Team,

I am aware that we can able to pull the license usage stats in splunk for index, host and sourcetype for a day. But whereas I want to pull the license usage stats in GB for last 30 days.

I have two requirement seperately to pull the exact license usage stats for last 30 days in Splunk.

1.)The first one would be based on the app and severity of how much logs are ingested in GB for last 30 days for both the index.

index=abc OR index=xyz app IN (splunk,"Splunk-Daemon") severity=informational

================================================================================

2.) The second condition would be based on a index for two sourcetypes with a particular keyword. 

2.) index=abc sourcetype IN ("efg","ijk") "www.splunk.com*"

 

So for each requirement how can I be able to pull the license usage in Splunk for last 30 days. Kindly help on the same.

0 Karma

anandhalagaras1
Contributor

Hi Team,

 

Can anyone help on my query please.

0 Karma

anandhalagaras1
Contributor

Can anyone help on my query please.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...