Splunk Search

How to edit my search to display daily license usage and total license usage on a chart, with current license volume as a chart overlay?

sassens1
Path Finder

Hi

I'm struggling to find out how to add an overlay or something that will display the daily license usage for specific indexes and the total daily license usage. I'd also like to add our current license volume as a horizontal line. Everything on one graph.

almost correct:

index=_internal source=*license_usage.log type=Usage
(idx=cust_1 OR idx=cust_l2 OR idx=cust_3OR idx=cust_4 OR idx=cust_5 OR idx=cust_6) 
| timechart span=1d eval(round(sum(b)/1024/1024/1024,2)) AS "GB Used"
| appendcols [search index=_internal source=*license_usage.log type=Usage | timechart span=1d eval(round(sum(b)/1024/1024/1024,2)) AS "Total GB Used"] 

another try:

index=_internal source=*license_usage.log type=Usage
(idx=cust_1 OR idx=cust_l2 OR idx=cust_3 OR idx=cust_4 OR idx=cust_5OR idx=cust_6)
| bucket _time span=1d
| stats sum(b) AS bytes by _time | eval GB = round(bytes/1024/1024/1024,2)
| appendcols [search index=_internal source=*license_usage.log type=Usage | bucket _time span=1d  |stats sum(b) AS bytes by _time | eval GB1= round(bytes/1024/1024/1024,2)| eval limit = 500]
| table GB, GB1, limit

I'm not really sure it's the best way to do it, sure it lacks optimization 😕
Any idea to fix this? thanks

1 Solution

somesoni2
Revered Legend

Give this a try

index=_internal source=*license_usage.log type=Usage
| eval specific=if(idx="cust_1" OR idx="cust_l2" OR idx="cust_3" OR idx="cust_4" OR idx="cust_5" OR idx="cust_6",b,0) 
| timechart span=1d eval(round(sum(specific)/1024/1024/1024,2)) AS "GB Used" eval(round(sum(b)/1024/1024/1024,2)) AS "Total GB Used"

To add Current license quota, you can add following portion to the end of above search. Please note that below query requires access to license server instance, so you would need to add your license server instance as search peer to your search heads (where you'll run this)

..above search ..| eval "License Quota"=[| rest /services/licenser/licenses | search group_id="Enterprise" status="VALID" | stats sum(quota) as query | eval query=(query/1024/1024/1024)]

View solution in original post

somesoni2
Revered Legend

Give this a try

index=_internal source=*license_usage.log type=Usage
| eval specific=if(idx="cust_1" OR idx="cust_l2" OR idx="cust_3" OR idx="cust_4" OR idx="cust_5" OR idx="cust_6",b,0) 
| timechart span=1d eval(round(sum(specific)/1024/1024/1024,2)) AS "GB Used" eval(round(sum(b)/1024/1024/1024,2)) AS "Total GB Used"

To add Current license quota, you can add following portion to the end of above search. Please note that below query requires access to license server instance, so you would need to add your license server instance as search peer to your search heads (where you'll run this)

..above search ..| eval "License Quota"=[| rest /services/licenser/licenses | search group_id="Enterprise" status="VALID" | stats sum(quota) as query | eval query=(query/1024/1024/1024)]

View solution in original post

sassens1
Path Finder

nice it works like a charm thanks!

However I have only values for the last 30 days on my _internal index, is it normal?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!