Splunk Search

How to edit my search to find the amount of license usage per Active Directory event code?

sbattista09
Contributor

how would i search to see how the amount of license usage per Active Directory (AD) event code?
looking to add it to this search if possible

index=_internal source=*license_usage.log type="Usage" st=MyWindowsLogs | bin _time span=1h | stats sum(b) as b by _time, pool, s, st, h, idx | timechart limit=0 span=1d sum(b) AS volumeB by st fixedrange=false | bin _time span=1d | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] | addtotals
0 Karma
1 Solution

rjthibod
Champion

You would have to look at the length of the raw data per event code in the actual index, not the internal metrics.

index=* sourcetype=MyWindowsLogs | stats sum(eval(length(_raw))) as size by EventCode

View solution in original post

rjthibod
Champion

You would have to look at the length of the raw data per event code in the actual index, not the internal metrics.

index=* sourcetype=MyWindowsLogs | stats sum(eval(length(_raw))) as size by EventCode

sbattista09
Contributor

the size is in bytes i assume?

0 Karma

rjthibod
Champion

Yes, those are bytes.

0 Karma

sbattista09
Contributor

Awesome, thanks!

0 Karma

rjthibod
Champion

No problem

0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...