Hi @sverdhan , sorry but your requirement isn't so clear: if a sourcetype didn't reported in the last 30 days, how can you calculate their volume? it's always 0 in the last 30 days. Maybe you want...
See more...
Hi @sverdhan , sorry but your requirement isn't so clear: if a sourcetype didn't reported in the last 30 days, how can you calculate their volume? it's always 0 in the last 30 days. Maybe you want the logs in the last 6 months, calculating their total volume highlighting if they aren't sending logs from 30 days. in this case, you can apply a solution like the one you shared. Anyway, to calculate volume you have two solution: a more performant (but less precise) solution that uses a medium value (e.g. 1k) for each event. the calculation of volume using the search from license consuming: if the sourcetypes to monitor ar in a lookup called perimeter.csv: | tstats count latest(_time) AS lastTime where index=* [| inputlookup perimeter.csv | fields sourcetype ] earliest=-180d latest=now BY host
| eval period=if lastTime>now()-86400*30,"Latest","Previous")
| stats
sum(count) AS count
dc(period) As period_count
values(period) AS period
BY host
| eval status=case(period_count=2,"Always present",period="Latest","Only last Month",period="Previous","Only Previous")
| eval volume=count*1/1024/1024
| table host status volume if instead you want a more detailed solutions but very less performant, you could try: index=_internal [ rest splunk_server=local /services/server/info
| return host] source=*license_usage.log* type="Usage"
[| tstats count latest(_time) AS lastTime where index=* [| inputlookup perimeter.csv | fields sourcetype ] earliest=-180d latest=now BY host | fields host ]
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| bin _time span=1d
| stats sum(b) as b by _time, pool, s, st, h, idx
| timechart span=1d sum(b) AS volumeB by h fixedrange=false
| fields - _timediff
| foreach "*"
[ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] Ciao. Giuseppe