Splunk Search

Does anyone know a search query to find license usage by fwdType?

Path Finder

Hi All,

Need splunk query which should tell how much license is used by forwarder type, since we are planning migrating from UF to HF.

I was able to get the fwdType details by below search, but now need to get usage by the fwdType. Please help on this.
index=_internal source=metrics.log "os=Windows" "fwdType=*" | dedup os,hostname | rename hostname as host | chart count by fwdType


0 Karma


Forwarder sends anything you want it to. Since HF is going to be in scope for you pretty soon, i am assuming you're going to use it for filtering events? Let's say filtered data is set to send data to index=xyz.
Use |dbinspect to get the raw size on disk in MB / 1024 to get amount of raw data on MB which should be ~license usage in GB. Again, if another HF is set to send data to same index, i am not sure at that point. Click on Settings>Licensing>Usage Reports, it should give you some ideas. Not sure if there's a direct way.hope this helps.

0 Karma