Need to pull the Top 100 Hosts License Usage In Splunk Cloud

[anandhalagaras1]

Need to pull the License Usage in GB for the top 100 Host along with their respective Index Source and Souretype information on monthly basis for reports.

So kindly help with the query. 

[gcasaldi]

try like this (select time range from the search):

index=_internal source=*license_usage.log type="Usage"
| stats sum(b) as totalBytes by host, index, source, sourcetype
| eval host=lower(host)
| eval MB=totalBytes/1024/1024
| eval GB=round(MB/1024,2)
| sort - GB
| head 100
| table host index source sourcetype GB


Let me know 🙂 
Best,

Giulia

[anandhalagaras1]

@gcasaldi 

Here it just pulls the cluster master server information with GB when I ran the query for last month and not any other results. Refer screenshot for reference.

[gcasaldi]

right, change the index, for license:

index=summary 
| stats sum(b) as totalBytes by host, index, source, sourcetype
| eval host=lower(host)
| eval MB=totalBytes/1024/1024
| eval GB=round(MB/1024,2)
| sort - GB
| head 100
| table host index source sourcetype GB

Best,

Giulia

[anandhalagaras1]

@gcasaldi Now also i am getting the hostname of Clustermaster and not the client machine information.

I need to get the top 100 client machines with their respective index source and sourcetype information 

[gcasaldi]

You can achieve this by leveraging internal indexes and configuring a report. Here's how:

Search Query below

This search query retrieves license usage data by host for a specific time range:

index=_internal source=*license_usage.log type="Usage" | eval host=lower(host) # Standardize hostname (optional) | eval MB=b/1024/1024 # Convert bytes to Megabytes | eval GB=round(MB/1024,2) # Convert Megabytes to Gigabytes (round to 2 decimals) | search earliest=-1mo@d latest=now@d # Adjust timeframe as needed (e.g., -3mo@d for past 3 months) | sort - GB # Sort by license usage in descending order | head 100 # Limit results to top 100 hosts | table host GB source sourcetype

[anandhalagaras1]

@gcasaldi ,

Thank you for your prompt response. For example, I want to pull the report for the entire month of May (from May 1st to May 31st, 2024) for the top 100 hosts by license usage, along with their index, host, source, and sourcetype. I used the following query:

index=_internal source=*license_usage.log type="Usage" | eval host=lower(host) | eval MB=b/1024/1024 | eval GB=round(MB/1024,2) | search earliest=-1mo@d latest=now@d | sort - GB | head 100 | table host index source sourcetype GB
```

However, the query seems to be running continuously and does not produce any results. It is still running when I search for the previous month in the Search and Reporting app. Could you please let me know where I might have made a mistake?