...ave the DC, file server, and 3 workstations deployed. I keep getting licenseusage warnings. Upon investigation, the CentOS server where the Splunk server is installed is by far the largest license u...
Hi,
I have made one search for finding the licenseusages for indexes that is given below.
index=_internal source=*license_usage.log type=usage (idx=*) | eval MB = round(b/1048576,2) | eval s...
Please help me fix this SPL to produce the licenseusage listed above. Thx a million This is not working for me: index="_internal" | stats sum(GB) as A by Date, idx | eventstats max(A) as B by i...
I see in the docs splunk doc that summary indexing does not count against your license. It also says that summary indexes are built via transforming searches over event data.
If I u...
I know that since 4.1 summary indexing does not count against license anymore. However, what if I have multiple summary indexes?
According to this answer, I'd say more indexes would not affect t...
...he second one is a Indexer and Seach Head.
To minimize workload on Seach Head I tried to turn on indexing ( indexAndForward ) on HF and found that Splunk started using the licence twice faster t...
I have wrote a query to find out the licenseusage by host. But I need to find out the top 10 hosts or indexes in terms of licenseusage. I have written the following query.
index=_internal s...
Splunk 6.1's licenseusage reporting will let me view my licenseusage by index for the last 30 days, but the graph only shows 10 indexes. The rest are presumably in the entry titled "OTHER". How d...
...alue per index, i can get a value per team.
Current Search:
index=_internal source=*license_usage.log type=Usage | rename idx AS index | timechart span=1d eval(round(sum(b)/1024/1024/1024,2)) AS "T...