Splunk Search

How to sum up all the events in all the indexers with a month total?

juanv
Engager

I'm trying to see if there is a report or a query I can run to sum up all the events in all the indexers with a month total? I tried this but i'm not sure if this is the right search:

index=* | stats count by Period

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

That query probably won't work unless every event you have has a field called "Period".

The Monitoring Console should have a dashboard that provides what you're looking for.  Look under Indexing->License Usage->History License Usage.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

As @richgalloway already pointed out, you can't aggregate data by a field that's not in your events. And a "Period" field most probably isnt't there.

Furthermore - unless you want to do a comparison of two different periods, you'd simply just pick a time range with the timepicker to contain a single day/week/month/whatever or use earliest= and latest= constraints within the search itself.

And you'd probably want to use tstats instead of stats - calculating stats over summaries is way way faster than searching from raw indexes.

You can also use either the license report directly, as @richgalloway said or look and calculate your stats over the index=_internal source=*/license_usage.log

There are a few options to get the stats - which one to use depends on what you need it for.

richgalloway
SplunkTrust
SplunkTrust

That query probably won't work unless every event you have has a field called "Period".

The Monitoring Console should have a dashboard that provides what you're looking for.  Look under Indexing->License Usage->History License Usage.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...