Why is my license usage search by app not showing information for all apps in my environment?

[sunnyparmar]

Hi,

I have a search mentioned below to see license usage per app, but the issue I am facing is, if I run the search without this portion ( | chart sum(GB) by app_name) at the end, then it gives the license usage for all apps with their indexes and sourcetypes respectively. However, if I exclude it from the end, then it is not showing license usage for all the apps. Kindly suggest for this.

index=_internal source=*license_usage.log type="Usage" | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)  | eval sourcetypename = st  | bin _time span=1d  | stats sum(b) as b by _time, pool, indexname, sourcetypename | eval GB=round(b/1024/1024/1024, 3)| fields _time, indexname, sourcetypename, GB |  join sourcetypename [       | rest /services/saved/sourcetypes       | fields title, "eai:acl.app"       | rename title AS sourcetypename, "eai:acl.app" AS app_name  ] | chart sum(GB) by app_name

Thanks

[renjith_nair]

You have mentioned before, the result of the below search is missing the three app names. Then what you mean by "Yes" to the question " Are those three apps coming as part of original detailed search?" . Sorry just trying to understand the problem.

 index=_internal source="*license_usage.log" type="Usage" 
   | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | eval sourcetypename = st | bin _time span=1d 
   | stats sum(b) as b by _time, pool, indexname, sourcetypename | eval GB=round(b/1024/1024/1024, 3)
   | fields _time, indexname, sourcetypename, GB 
   | join sourcetypename [ | rest /services/saved/sourcetypes | fields title, "eai:acl.app" | rename title AS sourcetypename, "eai:acl.app" AS app_name ]|table app_name|dedup app_name

If you are not getting those three apps as part of this search, then it could be your join is eliminating the apps (few sourcetypes missing from any of the two searches)
Try this again and see if you have any "Not Found" in app name.

   index=_internal source="*license_usage.log" type="Usage" 
       | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | eval sourcetypename = st | bin _time span=1d 
       | stats sum(b) as b by _time, pool, indexname, sourcetypename | eval GB=round(b/1024/1024/1024, 3)
       | fields _time, indexname, sourcetypename, GB 
       | join sourcetypename type=outer [ | rest /services/saved/sourcetypes | fields title, "eai:acl.app" | rename title AS sourcetypename, "eai:acl.app" AS app_name ]|eval app_name=coalesce(app_name,"Not Found" |stats count by app_name

If the above is also not working for youo then get one of the app from the missing three and then search for it in the results of original detailed search(the main search with join)

[sunnyparmar]

sorry .. took your first question in wrong meaning. First question answer is "no". those three apps are not the part of original detailed search as i was mentioned earlier. By executing your above given query i am getting the error message below -

"Error in 'eval' command: The expression is malformed. Expected ). "

Thanks

[renjith_nair]

no problem. I missed a ")" in eval . just replace it with|eval app_name=coalesce(app_name,"Not Found")|stats count by app_name

OK so if it's not in your detailed search, it's not the problem with stats. Now we need to look at the join command. It's possible that the sourcetypes from your missing 'three' apps might not be sending the data and hence the sourcetype is not matching in "join" . Get the sourcetypes from those missing apps and see if it's sending any data.

Hope now you will be able to identify the reason.

[sunnyparmar]

By using below parameter i am able to enlisted all the apps in the result but when i am going to replace it with my final search query parameter (| rest /services/saved/sourcetypes ), it won't work. Do you have any idea on this?

| REST /services/apps/local splunk_server=local | table label

Thanks

[sunnyparmar]

Thanks for the correction. Now i have start getting data in "Not found". The index and sourcetype i am getting is -

 index                       sourcetype

qv-perfmon Perfmon:CPUTime

qv-perfmon Perfmon:FreeDiskSpace

qv-perfmon Perfmon:Memory

qv-winevents WinEventLog:Application

qv-winevents WinEventLog:Security

qv-winevents WinEventLog:System

Now the issue is that these are common sourcetypes as you know that while fetching logs for host health checks in splunk these are the common sourcetypes that we have to define in inputs.conf file so could you please tell me that how to overcome through this issue.

Thanks