Splunk Search

License Usage by Host over time

dbecker_AU
Engager

We are using Splunk 6.0.1, and I found a search that generates license usage by host:

index=_internal source=*license_usage.log type=Usage | stats sum(b) as bytes by h | eval MB = round(bytes/1024/1024,1) | fields h MB | rename h as host | sort -MB

What I'd like to do is extend it further to 24 hour spans. The closest I've come is breaking it down by day:

index=_internal source=*license_usage.log type=Usage | eval MB = round(b/1024/1024,1) | timechart per_day(MB) by h span=24h

...but the end always shows today's stats looking much lower because there isn't enough data.

Is there a way to get per_day to start at the current time rather than midnight?

0 Karma

rmorlen
Splunk Employee
Splunk Employee

You can play around with this. We typically do earliest=@d so that we know the percent we have used today but you should be able to get what you want from this.

index=_internal source=*license* type=Usage | stats sum(b) as BytesUsed max(poolsz) as PoolSize by pool | eval percent = BytesUsed/PoolSize | eval LicenseUsedInGB=round(BytesUsed/1024/1024/1024,2) | eval PoolSizeInGB=PoolSize/1024/1024/1024 | eval PercentUsed=round(percent*100,3) | fields PoolSizeInGB LicenseUsedInGB PercentUsed

You can also look at the latest SoS. The licensing info is accurate and you can tweak the searches form that.

lukejadamec
Super Champion

Use the time picker and select the days from midnight to midnight.

0 Karma

dbecker_AU
Engager

I tried that, but it still divides by calendar day, so today only reports from midnight to the current time.

0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...