Splunk Search

License Usage by Host over time

dbecker_AU
Engager

We are using Splunk 6.0.1, and I found a search that generates license usage by host:

index=_internal source=*license_usage.log type=Usage | stats sum(b) as bytes by h | eval MB = round(bytes/1024/1024,1) | fields h MB | rename h as host | sort -MB

What I'd like to do is extend it further to 24 hour spans. The closest I've come is breaking it down by day:

index=_internal source=*license_usage.log type=Usage | eval MB = round(b/1024/1024,1) | timechart per_day(MB) by h span=24h

...but the end always shows today's stats looking much lower because there isn't enough data.

Is there a way to get per_day to start at the current time rather than midnight?

0 Karma

rmorlen
Splunk Employee
Splunk Employee

You can play around with this. We typically do earliest=@d so that we know the percent we have used today but you should be able to get what you want from this.

index=_internal source=*license* type=Usage | stats sum(b) as BytesUsed max(poolsz) as PoolSize by pool | eval percent = BytesUsed/PoolSize | eval LicenseUsedInGB=round(BytesUsed/1024/1024/1024,2) | eval PoolSizeInGB=PoolSize/1024/1024/1024 | eval PercentUsed=round(percent*100,3) | fields PoolSizeInGB LicenseUsedInGB PercentUsed

You can also look at the latest SoS. The licensing info is accurate and you can tweak the searches form that.

lukejadamec
Super Champion

Use the time picker and select the days from midnight to midnight.

0 Karma

dbecker_AU
Engager

I tried that, but it still divides by calendar day, so today only reports from midnight to the current time.

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...