Hello everyone,
I'm creating a search to calculate the license usage in last 30 days by day per hour. What table I want is attached as a picture
The search I tried is the one mentioned below. but I'm definitely missing the points here.
earliest-@d-30d latest=@d-1s index=_internal source=license_usage.log type=Usage | timechart span=1h sum(b) as bytes by date_mday | eval MB=round(byte/1024/1024,2) | fields _time date_mday MB
Thanks in advance
@splunk_kk, try the following based on Splunk's Licence Monitoring Query
index=_internal
[ `set_local_host`] source=*license_usage.log* type="RolloverSummary" earliest=-30d@d
| bin _time span=1h
| stats latest(b) AS b by slave, pool, _time
| eval Date="Date:".strftime(_time,"%Y/%m/%d")
| eval Time=strftime(_time,"%H").":00"
| chart sum(b) AS "volume" by Time Date fixedrange=false limit=31 useother=f
| fields - _timediff
| foreach "Date:*"
[ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]
| rename "Date:*" as "*"
PS: The macro set_local_host
is defined in Search
App hence in order to use this outside of Search App you would need to use the underlying query instead or make the macro global.... ie. use the following instead of [
set_local_host]
[rest splunk_server=local /services/server/info | return host]