Splunk Search

How to search for all Indexes and sort by amount indexed per day / license ?

shandman
Path Finder

I'm trying to write a search where I can list all indexes in our Splunk environment, and ingestion rate per day. i.e. license usage.

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

I have a "chargeback" dashboard that does this. We do it by index (sometimes combining a couple of them per customer), but I think it is what you want. You should be able to do something like this:

index=_internal source=*license_usage.log type="Usage" | stats sum(b) as b by idx | eval GB=(b/1024/1024/1024) | sort -GB | fields - b

View solution in original post

shandman
Path Finder

This is perfect! Thank you! I just need to get results back from the search now... ideas?

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

I have a "chargeback" dashboard that does this. We do it by index (sometimes combining a couple of them per customer), but I think it is what you want. You should be able to do something like this:

index=_internal source=*license_usage.log type="Usage" | stats sum(b) as b by idx | eval GB=(b/1024/1024/1024) | sort -GB | fields - b
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...