We are using Splunk 6.0.1, and I found a search that generates license usage by host:
index=_internal source=*license_usage.log type=Usage | stats sum(b) as bytes by h | eval MB = round(bytes/1024/1024,1) | fields h MB | rename h as host | sort -MB
What I'd like to do is extend it further to 24 hour spans. The closest I've come is breaking it down by day:
index=_internal source=*license_usage.log type=Usage | eval MB = round(b/1024/1024,1) | timechart per_day(MB) by h span=24h
...but the end always shows today's stats looking much lower because there isn't enough data.
Is there a way to get per_day to start at the current time rather than midnight?
You can play around with this. We typically do earliest=@d so that we know the percent we have used today but you should be able to get what you want from this.
index=_internal source=*license* type=Usage | stats sum(b) as BytesUsed max(poolsz) as PoolSize by pool | eval percent = BytesUsed/PoolSize | eval LicenseUsedInGB=round(BytesUsed/1024/1024/1024,2) | eval PoolSizeInGB=PoolSize/1024/1024/1024 | eval PercentUsed=round(percent*100,3) | fields PoolSizeInGB LicenseUsedInGB PercentUsed
You can also look at the latest SoS. The licensing info is accurate and you can tweak the searches form that.
Use the time picker and select the days from midnight to midnight.
I tried that, but it still divides by calendar day, so today only reports from midnight to the current time.