Hello,
I would like to track the license consumption as from time to time it is 4 times higher (per day) than expected. I suspect this is because our systems are in the QEC phase and produce more logs, e.g. after someone activates additional traces/debug mode.
I am identifying the file / source type responsible for the growth using the following:
index=si_license_usage idx="mlbso" st=BWP_hanatraces | eval Gb=round(b_hourly/1024/1024/1024,12) | bucket span=1d _time |sort -b_hourly
What comes out is that the files with the pattern indexserver are causing the most consumption. This is expected.
As they have restricted size, I would be now interested to see how often they are written / transferred to Splunk.
So I thought I would use sth. like below to get the chart of the distinct files / sources per hour:
| metadata type=sources index=mlbso sourcetype=BWP* | search source="*indexserver*" | timechart span=1h count
but the last part with timechart does not return any result, so I guess I do sth wrong.
Could you please help?
Kind Regards,
Kamil
