Splunk Search

timechart of license used

mcbradford
Contributor

I am using the following to tell me what my license usage is when I run this search.

index=_internal source=*license_usage.log earliest=@d+30m| eval GB=b/1024/1024/1024 | stats sum(GB) by pool | eval used='sum(GB)' | eval GB_Used_Today=round(used, 0) | fields GB_Used_Today

I would like to do the same, but use a timechart to show license usage per day for the past X days.

Ideas?

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

see http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume
and be aware of the difference between pre 4.2*, 4.2 and 4.3+

4.2


index=_internal source=*license_usage.log earliest=@d+30m| eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by pool

4.3


index=_internal source=*license_usage.log type=RolloverSummary | eval GB=b/1024/1024/1024 bucket _time span=1d | stats sum(GB) by _time pool

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...