Splunk Search

How to write a search to charge license usage and the license cap?

Path Finder

Hello,

I need to chart a license usage that will also include the license cap as well (two lines)

0 Karma

Ultra Champion

Alternatively, you can look at -

alt text

And -

alt text

0 Karma

Motivator
index=_internal source="*license_usage.log" type=RolloverSummary | timechart span=1d sum(b) AS DailyVolume | eval DailyVolume=round(DailyVolume/1024/1024/1024,2) | eval License="5"
0 Karma

SplunkTrust
SplunkTrust

This should give you what you desire (use the appropriate span in timechart)

index=_internal sourcetype=splunkd source=*license_usage.log type=usage | timechart sum(b) as usage max(poolsz) as quota by pool | foreach usage* quota* [eval "<<FIELD>>"=round('<<FIELD>>'/(1024*1024*1024),3) ]
0 Karma