Splunk Search

How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

lwaddep1
New Member

How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

Particular indexer is pumping lot of data recently, we want to have a report for the index by host and source for the past 7 days.

0 Karma
1 Solution

somesoni2
Revered Legend

Try this

index=_internal sourcetype=splunkd source=*license_usage.log type=Usage idx=YourIndexNameHere
| eval host=coalesce(h,"<<SQUASHED>>") | eval source=coalesce(s,"<<SQUASHED>>")
| stats sum(b) as usage by host source
| eval usageMB=round(usage/1024/1024,3)

View solution in original post

0 Karma

somesoni2
Revered Legend

Try this

index=_internal sourcetype=splunkd source=*license_usage.log type=Usage idx=YourIndexNameHere
| eval host=coalesce(h,"<<SQUASHED>>") | eval source=coalesce(s,"<<SQUASHED>>")
| stats sum(b) as usage by host source
| eval usageMB=round(usage/1024/1024,3)
0 Karma

traxxasbreaker
Communicator

Just want to note that this search will only show an accurate breakdown by source if your combination of indexes, sourcetype, sources, and hosts is below the "squashing threshold". Index and sourcetype are guaranteed to remain accurate with a large number of combinations but the others are not. See this answer for some more details.

0 Karma

lwaddep1
New Member

Thanks for your response, i verified query it worked for past 7 days of usage. I want to break this per day for last 7 days. how can i do it?

0 Karma

lwaddep1
New Member

what changes does it need if we want to capture the same data in a timechart ?

0 Karma

lwaddep1
New Member

Thanks for the quick response, appreciate your help.

0 Karma

somesoni2
Revered Legend

Like this

 index=_internal sourcetype=splunkd source=*license_usage.log type=Usage idx=YourIndexNameHere
| bucket span=1d _time
 | eval host=coalesce(h,"<<SQUASHED>>") | eval source=coalesce(s,"<<SQUASHED>>")
 | stats sum(b) as usage by _time host source
 | eval usageMB=round(usage/1024/1024,3)
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...