...he search results: spl index=_internal source="*license_usage.log" Is there a method to check licensing usage per index through a search query on the Indexer server in System B? Your a...
Hi,
I have made one search for finding the licenseusages for indexes that is given below.
index=_internal source=*license_usage.log type=usage (idx=*) | eval MB = round(b/1048576,2) | eval s...
...ave the DC, file server, and 3 workstations deployed. I keep getting licenseusage warnings. Upon investigation, the CentOS server where the Splunk server is installed is by far the largest license u...
Please help me fix this SPL to produce the licenseusage listed above. Thx a million This is not working for me: index="_internal" | stats sum(GB) as A by Date, idx | eventstats max(A) as B by i...
I have wrote a query to find out the licenseusage by host. But I need to find out the top 10 hosts or indexes in terms of licenseusage. I have written the following query.
index=_internal s...
I know that since 4.1 summary indexing does not count against license anymore. However, what if I have multiple summary indexes?
According to this answer, I'd say more indexes would not affect t...
Splunk 6.1's licenseusage reporting will let me view my licenseusage by index for the last 30 days, but the graph only shows 10 indexes. The rest are presumably in the entry titled "OTHER". How d...
...he second one is a Indexer and Seach Head.
To minimize workload on Seach Head I tried to turn on indexing ( indexAndForward ) on HF and found that Splunk started using the licence twice faster t...
When I run the below search I can see 94 indexes available.
| eventcount summarize=false index=* index=_*| dedup index | fields index
But when I run the below search to check the licenseusage...