Splunk Search

How to search and develop a chart for license usage by index over 2 days with column displaying the percent change?

brywilk_umich
Path Finder

Hi All,

Does anyone have a search/report that shows all of your indexes with usage by day vs the previous day with a column for percent change?

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try (run from license master node. You can run from any Search Head if you're forwarding your license master logs to Indexers). License usage shown in GB. Compares today vs yesterday.

index=_internal sourcetype=splunkd source=*license_usage.log type=usage earliest=-1d@d 
| eval day=if(_time>relative_time(now(),"@d"),"today","yesterday") | chart sum(b) as usage by idx day
| eval today=round(today/1024/1024/1024,3) | eval yesterday=round(yesterday/1024/1024/1024,3)
| eval percent_change=round((today-yesterday)*100/yesterday,2)

View solution in original post

somesoni2
Revered Legend

Give this a try (run from license master node. You can run from any Search Head if you're forwarding your license master logs to Indexers). License usage shown in GB. Compares today vs yesterday.

index=_internal sourcetype=splunkd source=*license_usage.log type=usage earliest=-1d@d 
| eval day=if(_time>relative_time(now(),"@d"),"today","yesterday") | chart sum(b) as usage by idx day
| eval today=round(today/1024/1024/1024,3) | eval yesterday=round(yesterday/1024/1024/1024,3)
| eval percent_change=round((today-yesterday)*100/yesterday,2)

brywilk_umich
Path Finder

Perfect! Thanks!

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...