Splunk Search

How to write a Splunk search for License Utilization for Particular events?

umesh
Path Finder

Hi ,

 

i want to find the license utilization of  firewall logs based on severity level. can anyone help me with the query on how to find the license utilization based on particular events like eventid in windows logs

Labels (5)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Splunk's license usage log tracks utilization by index, host, source, sourcetype, and pool, but not severity.  You'll have to it yourself by adding up the sizes of all of the relevant events.  This method may not match the number calculated by Splunk, but should be close enough.

index=firewall sourcetype=firewall 
| eval size=len(_raw)
| stats sum(size) as TotalSize by severity
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

johnhuang
Motivator

You can approximate license utilization by counting the number of events instead of calculating the exact size. This is faster and could meet your use case.

For example, windows event log:

<base search>
| top 100 EventCode 

 

 

richgalloway
SplunkTrust
SplunkTrust

Splunk's license usage log tracks utilization by index, host, source, sourcetype, and pool, but not severity.  You'll have to it yourself by adding up the sizes of all of the relevant events.  This method may not match the number calculated by Splunk, but should be close enough.

index=firewall sourcetype=firewall 
| eval size=len(_raw)
| stats sum(size) as TotalSize by severity
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...