Splunk Search
Highlighted

How to edit my search to find the amount of license usage per Active Directory event code?

Contributor

how would i search to see how the amount of license usage per Active Directory (AD) event code?
looking to add it to this search if possible

index=_internal source=*license_usage.log type="Usage" st=MyWindowsLogs | bin _time span=1h | stats sum(b) as b by _time, pool, s, st, h, idx | timechart limit=0 span=1d sum(b) AS volumeB by st fixedrange=false | bin _time span=1d | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] | addtotals
0 Karma
Highlighted

Re: How to edit my search to find the amount of license usage per Active Directory event code?

Champion

You would have to look at the length of the raw data per event code in the actual index, not the internal metrics.

index=* sourcetype=MyWindowsLogs | stats sum(eval(length(_raw))) as size by EventCode

View solution in original post

Highlighted

Re: How to edit my search to find the amount of license usage per Active Directory event code?

Contributor

the size is in bytes i assume?

0 Karma
Highlighted

Re: How to edit my search to find the amount of license usage per Active Directory event code?

Champion

Yes, those are bytes.

0 Karma
Highlighted

Re: How to edit my search to find the amount of license usage per Active Directory event code?

Contributor

Awesome, thanks!

0 Karma
Highlighted

Re: How to edit my search to find the amount of license usage per Active Directory event code?

Champion

No problem

0 Karma