Splunk Search
Highlighted

How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

New Member

How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

Particular indexer is pumping lot of data recently, we want to have a report for the index by host and source for the past 7 days.

0 Karma
Highlighted

Re: How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

SplunkTrust
SplunkTrust

Try this

index=_internal sourcetype=splunkd source=*license_usage.log type=Usage idx=YourIndexNameHere
| eval host=coalesce(h,"<<SQUASHED>>") | eval source=coalesce(s,"<<SQUASHED>>")
| stats sum(b) as usage by host source
| eval usageMB=round(usage/1024/1024,3)

View solution in original post

0 Karma
Highlighted

Re: How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

New Member

Thanks for your response, i verified query it worked for past 7 days of usage. I want to break this per day for last 7 days. how can i do it?

0 Karma
Highlighted

Re: How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

SplunkTrust
SplunkTrust

Like this

 index=_internal sourcetype=splunkd source=*license_usage.log type=Usage idx=YourIndexNameHere
| bucket span=1d _time
 | eval host=coalesce(h,"<<SQUASHED>>") | eval source=coalesce(s,"<<SQUASHED>>")
 | stats sum(b) as usage by _time host source
 | eval usageMB=round(usage/1024/1024,3)
0 Karma
Highlighted

Re: How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

New Member

Thanks for the quick response, appreciate your help.

0 Karma
Highlighted

Re: How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

New Member

what changes does it need if we want to capture the same data in a timechart ?

0 Karma
Highlighted

Re: How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

Communicator

Just want to note that this search will only show an accurate breakdown by source if your combination of indexes, sourcetype, sources, and hosts is below the "squashing threshold". Index and sourcetype are guaranteed to remain accurate with a large number of combinations but the others are not. See this answer for some more details.

0 Karma