Splunk Search

How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

lwaddep1
New Member

How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

Particular indexer is pumping lot of data recently, we want to have a report for the index by host and source for the past 7 days.

0 Karma
1 Solution

somesoni2
Revered Legend

Try this

index=_internal sourcetype=splunkd source=*license_usage.log type=Usage idx=YourIndexNameHere
| eval host=coalesce(h,"<<SQUASHED>>") | eval source=coalesce(s,"<<SQUASHED>>")
| stats sum(b) as usage by host source
| eval usageMB=round(usage/1024/1024,3)

View solution in original post

0 Karma

somesoni2
Revered Legend

Try this

index=_internal sourcetype=splunkd source=*license_usage.log type=Usage idx=YourIndexNameHere
| eval host=coalesce(h,"<<SQUASHED>>") | eval source=coalesce(s,"<<SQUASHED>>")
| stats sum(b) as usage by host source
| eval usageMB=round(usage/1024/1024,3)
0 Karma

traxxasbreaker
Communicator

Just want to note that this search will only show an accurate breakdown by source if your combination of indexes, sourcetype, sources, and hosts is below the "squashing threshold". Index and sourcetype are guaranteed to remain accurate with a large number of combinations but the others are not. See this answer for some more details.

0 Karma

lwaddep1
New Member

Thanks for your response, i verified query it worked for past 7 days of usage. I want to break this per day for last 7 days. how can i do it?

0 Karma

lwaddep1
New Member

what changes does it need if we want to capture the same data in a timechart ?

0 Karma

lwaddep1
New Member

Thanks for the quick response, appreciate your help.

0 Karma

somesoni2
Revered Legend

Like this

 index=_internal sourcetype=splunkd source=*license_usage.log type=Usage idx=YourIndexNameHere
| bucket span=1d _time
 | eval host=coalesce(h,"<<SQUASHED>>") | eval source=coalesce(s,"<<SQUASHED>>")
 | stats sum(b) as usage by _time host source
 | eval usageMB=round(usage/1024/1024,3)
0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...