Splunk Search

Query to find the license usage by a particular host or index on a daily basis

mintughosh
Path Finder

I need to know the license usage of 5 indexes on a daily basis. All the options I have been trying gives me the license usage of all the indexes.

Tags (1)
0 Karma
1 Solution

lquinn
Contributor

In the license usage logs there is a field called idx which denotes the index that the data is being written to. Doing a sum of the bytes field (b) by idx will give you the license usage per index:

index=_internal source="*license_usage.log" | stats sum(b) by idx

If you wanted to know the total for the five indexes, simply search for these indexes before doing the sum:

index=_internal source="*license_usage.log" idx="index1" OR idx="index2 OR idx="index3" OR idx="index4" OR idx="index5" | stats sum(b)

Similarly, "h" is the host field in the license_usage logs.

View solution in original post

0 Karma

lquinn
Contributor

In the license usage logs there is a field called idx which denotes the index that the data is being written to. Doing a sum of the bytes field (b) by idx will give you the license usage per index:

index=_internal source="*license_usage.log" | stats sum(b) by idx

If you wanted to know the total for the five indexes, simply search for these indexes before doing the sum:

index=_internal source="*license_usage.log" idx="index1" OR idx="index2 OR idx="index3" OR idx="index4" OR idx="index5" | stats sum(b)

Similarly, "h" is the host field in the license_usage logs.

0 Karma

mintughosh
Path Finder

Thank you, !!! If I want to include host and index both on the same query. License usage for 5 indexes and 2 hosts on this query and the usage should be in GB on daily basis.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...