Splunk Search

How to edit my search to find the amount of license usage per Active Directory event code?

sbattista09
Contributor

how would i search to see how the amount of license usage per Active Directory (AD) event code?
looking to add it to this search if possible

index=_internal source=*license_usage.log type="Usage" st=MyWindowsLogs | bin _time span=1h | stats sum(b) as b by _time, pool, s, st, h, idx | timechart limit=0 span=1d sum(b) AS volumeB by st fixedrange=false | bin _time span=1d | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] | addtotals
0 Karma
1 Solution

rjthibod
Champion

You would have to look at the length of the raw data per event code in the actual index, not the internal metrics.

index=* sourcetype=MyWindowsLogs | stats sum(eval(length(_raw))) as size by EventCode

View solution in original post

rjthibod
Champion

You would have to look at the length of the raw data per event code in the actual index, not the internal metrics.

index=* sourcetype=MyWindowsLogs | stats sum(eval(length(_raw))) as size by EventCode

View solution in original post

sbattista09
Contributor

the size is in bytes i assume?

0 Karma

rjthibod
Champion

Yes, those are bytes.

0 Karma

sbattista09
Contributor

Awesome, thanks!

0 Karma

rjthibod
Champion

No problem

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.