All,
This is another license utilization report mismatch.
I have request to generate license utilization report per day and save it for historical data.
I am using the 30 Days License Usage report as a base for my daily report:
index=_internal host=licensemaster source=*license_usage.log* type="RolloverSummary" earliest=-1d@d latest=-0d@d | bin _time span=1d | stats sum(b) as sumb last(stacksz) as laststacksz by _time component | eval sumgb=round(sumb/1024/1024/1024, 3) | eval laststackszgb=round(laststacksz/1024/1024/1024, 3)
And it is giving me the result as expected:
I want to go further and try to get the license utilization per hour, so I changed the search to:
index=_internal host=licensemaster source=*license_usage.log* type=Usage earliest=-1d@d latest=-0d@d | stats sum(b) as sumb last(poolsz) as lastpoolsz by _time | eval sumgb=round(sumb/1024/1024/1024, 3) | eval lastpoolszg=round(lastpoolsz/1024/1024/1024, 3) | addcoltotals sumb
But the result is lower than than the daily one:
967069668524 bytes is 900.656 Gb.
What am I doing wrong? I am running Splunk Enterprise 8.2.6.
Thank you,
Gerson Garcia
... View more