Monitoring Splunk

License usage for last 30 days by day per hour

splunk_kk
Path Finder

Hello everyone,

I'm creating a search to calculate the license usage in last 30 days by day per hour. What table I want is attached as a picture

alt text

The search I tried is the one mentioned below. but I'm definitely missing the points here.

earliest-@d-30d latest=@d-1s index=_internal source=license_usage.log type=Usage | timechart span=1h sum(b) as bytes by date_mday | eval MB=round(byte/1024/1024,2) | fields _time date_mday MB

Thanks in advance

0 Karma

niketn
Legend

@splunk_kk, try the following based on Splunk's Licence Monitoring Query

index=_internal 
    [ `set_local_host`] source=*license_usage.log* type="RolloverSummary" earliest=-30d@d 
| bin _time span=1h 
| stats latest(b) AS b by slave, pool, _time 
| eval Date="Date:".strftime(_time,"%Y/%m/%d") 
| eval Time=strftime(_time,"%H").":00" 
| chart sum(b) AS "volume" by Time Date fixedrange=false limit=31 useother=f
| fields - _timediff 
| foreach "Date:*" 
    [ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] 
| rename "Date:*" as "*"

PS: The macro set_local_host is defined in Search App hence in order to use this outside of Search App you would need to use the underlying query instead or make the macro global.... ie. use the following instead of [set_local_host]

[rest splunk_server=local /services/server/info | return host]
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...