Can someone help me how to modify the below query for different servers. For example, i have 10 servers like dbm1,dbm2,dbm3,....,dbm10. But i would like to see the output "total GB used" for each server for that sourcetype not for the group. Moreover, can I please know how to mention sourcetype in the query because when i say sourcetype=access_log , it is not working.
index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" type=Usage sourcetype=access_log | rex field=h "(ac1|bc1|cs1)(?P\w+[^\d+])" | search Group=dbm | eval GB = b/1024/1024 | rename s AS source | stats sum(GB) AS "Total GB used" by Group
I believe you will need to look into the interesting fields generated when running index=_internal source=*license_usage.log type=Usage and if not mistaken you will find a field called st that refers to the original source type.