Splunk Search

How to search the license usage per index per department?

Path Finder

I want the license usages per index per department.

department 1 has indexes:

idx             volume
acc_jboss       100
prod_jboss      150
test_jboss      50

department 1 volume is 300

department 2 has indexes

idx             volume
prod_network    1000
acc_network     509
test_network    100

department 2 volume is 1609

0 Karma

Revered Legend

Step 1: Create a lookup table file, say dept_index_lookup.csv with field department,index


Step 2 : Search License usage search like this

index=_internal source=*license_usage.log type=usage | stats sum(b) as usageGB by idx | eval usageGB=round(usage/1024/1024/1024,2)  | rename idx as index | lookup dept_index_lookup.csv index OUTPUT department | table department index usageGB
0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...