Splunk Search

How to get only the license usage of hosts in that lookup file?

vpantangi
Path Finder

Hi,
I can see the license usage of hosts in my environment by using this query:

index=_internal source=*license_usage.log type=Usage
 | stats sum(b) AS Bytes by h
 | eval GB = Bytes/1024/1024/1024
 | rename h as host
 | table host GB
 | sort -GB
 | addcoltotals

but i have to calculate only the license usage of dev environment hosts, i have created a lookup as dev.csv, but i am not sure how to get only the license usage of hosts in that lookup file.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this.

index=_internal source=*license_usage.log type=Usage [|inputlookup dev.csv | fields host | format]
| stats sum(b) AS Bytes by h
| eval GB = Bytes/1024/1024/1024
| rename h as host
| table host GB
| sort -GB
| addcoltotals

---
If this reply helps you, Karma would be appreciated.
0 Karma

aknsun
Path Finder

Am I missing something? I tried something similar, but it doesn't seem to return any data when using the lookup. My lookup has just 2 columns

host        DC
Host1     AWS
Host2     AWS
Host 3   OnPrem

Using what you mentioned earlier.

index=_internal source=*license_usage.log type=Usage [|inputlookup DataCentre.csv | fields host | format]
| stats sum(b) AS Bytes by h
| eval GB = Bytes/1024/1024/1024
| rename h as host
| table host GB
| sort -GB
| addcoltotals

0 Karma

vpantangi
Path Finder

No results found.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...