Splunk Search

How to edit my search to find the amount of license usage per Active Directory event code?

Contributor

how would i search to see how the amount of license usage per Active Directory (AD) event code?
looking to add it to this search if possible

index=_internal source=*license_usage.log type="Usage" st=MyWindowsLogs | bin _time span=1h | stats sum(b) as b by _time, pool, s, st, h, idx | timechart limit=0 span=1d sum(b) AS volumeB by st fixedrange=false | bin _time span=1d | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] | addtotals
0 Karma
1 Solution

Champion

You would have to look at the length of the raw data per event code in the actual index, not the internal metrics.

index=* sourcetype=MyWindowsLogs | stats sum(eval(length(_raw))) as size by EventCode

View solution in original post

Champion

You would have to look at the length of the raw data per event code in the actual index, not the internal metrics.

index=* sourcetype=MyWindowsLogs | stats sum(eval(length(_raw))) as size by EventCode

View solution in original post

Contributor

the size is in bytes i assume?

0 Karma

Champion

Yes, those are bytes.

0 Karma

Contributor

Awesome, thanks!

0 Karma

Champion

No problem

0 Karma