License Usage Calculation for a Particular Event ID

[anandhalagaras1]

Hi Team,

I want to find the license usage in GB for last 30 days for a particular Event ID for index=wineventlog so kindly help with the query.

The fields are:

EventCode=4688

index=wineventlog

sourcetype=winlog

[nickhills]

Did you set ratio to match the search sample ratio?

I am guessing you are not using sampling, so set the ratio=1

[anandhalagaras1]

@nickhills 

Thank you. I have changed the ratio to 1 in the query post which I can see the exact License consumption size in GB for EventCode=4688. 

Thanks for your help.

[nickhills · Accepted solution]

First, a correction. In my final query I should have removed "earliest=-24h latest=now" Please run the query again without those time constraints. (I have updated the original post)

Second, did you set a value for X? If you don't use sampling then ratio should be "ratio=1", if you used a 1:100,000 sampling ratio, then "ratio=100000"

Next, as I mentioned, Splunk measures volume licence against sourcetypes. It does not break licence usage down on a per field basis, hence the reason for the estimated calculation I have provided above.

If you want daily consumption, you can make a simple change to produce these values for each day.

index=wineventlog sourcetype=winlog EventCode=4688
| eval bytes=len(_raw)
| timechart avg(bytes) as avg_bytes count span=1d
| eval ratio=10000
| eval consumptionBytes=((avg_bytes*count)*ratio)
| eval consumptionKB=((avg_bytes*count)*ratio)/1024
| eval consumptionMB=((avg_bytes*count)*ratio)/1024/1024
| eval consumptionGB=((avg_bytes*count)*ratio)/1024/1024/1024

[anandhalagaras1]

So when i searched using the following query for Last 4 Days.

index=wineventlog sourcetype=winlog EventCode=4688
| eval bytes=len(_raw)
| timechart avg(bytes) as avg_bytes count span=1d
| eval ratio=10000
| eval consumptionBytes=((avg_bytes*count)*ratio)
| eval consumptionKB=((avg_bytes*count)*ratio)/1024
| eval consumptionMB=((avg_bytes*count)*ratio)/1024/1024
| eval consumptionGB=((avg_bytes*count)*ratio)/1024/1024/1024

I can see that the data has been split up into following fields but when i checked the consumption in GB it states some irrelevant value since we have opted for 150 GB of overall licensing per day. But here in this case the 5093.016298 GB value seems to be odd.

Not sure what is the mistake which i have done. So is there any possibility to pull the license usage for the EventCode=4688 in GB for last 30 days.

_time	avg_bytes	count	consumptionBytes	consumptionGB	consumptionKB	consumptionMB	ratio
12/11/2020	845.3536966	646899	5.46858E+12	5093.016298	5340414658	5215248.69	10000
12/12/2020	861.2122072	3300619	2.84253E+13	26473.155	27759114980	27108510.72	10000
12/13/2020	862.271559	3368060	2.90418E+13	27047.30581	28361155732	27696441.14	10000
12/14/2020	858.4715375	3338161	2.86572E+13	26689.06195	27985509824	27329599.44	10000
12/15/2020	857.6144705	2967960	2.54537E+13	23705.56299	24857084414	24274496.5	10000

[s2_splunk]

You set ratio=10000 in your search. Did you follow @nickhills  advice and select the corresponding sampling ratio when running the search (it doesn't look like you did, hence the 10000x consumption numbers):

[nickhills]

Splunk does not record licence consumption per event but you can make a good guess on this yourself.

Build a search which includes your events, and calculate the size in bytes of each event over 24 hours

index=wineventlog sourcetype=winlog EventCode=4688 earliest=-24h latest=now|eval bytes=len(_raw)

 Splunk uses UTF-8, so its 8bits, 1 byte per character.

Each event will be slightly different with varying hostnames and other parameters etc so calculate an average.

|stats avg(bytes) as avg_bytes

Now you need to know how many events there have been - I presume its a lot - a.) because you are asking, and b.) because 4688 is common and noisy!

You could run a |stats count over 30 days, but that may take some time. (Im also working on the assumption you don't have an accelerated datamodel for this)

This is a good use case for a sampled search, set a sample rate that matches your dataset. 1:10,000 or 1:100,000 is probably the ballpark.

To calculate the volume, you need to multiply the number of events the samples search returns by the avg_bytes and then multiply that by the ratio you choose.

So the complete search would be:

index=wineventlog sourcetype=winlog EventCode=4688
| eval bytes=len(_raw) 
| stats avg(bytes) as avg_bytes count 
| eval ratio=10000 
| eval consumptionBytes=((avg_bytes*count)*ratio) 
| eval consumptionKB=((avg_bytes*count)*ratio)/1024 
| eval consumptionMB=((avg_bytes*count)*ratio)/1024/1024 
| eval consumptionGB=((avg_bytes*count)*ratio)/1024/1024/1024

 remember to set "|eval ratio=x" to the sample ratio you use for the search

[anandhalagaras1]

Thank you for your swift response.

I  believe that we can able to calculate the license usage in GB per day based on the internal logs. So I used the following query and I can able to see the license usage in GB for the specific sourcetype "winlog"

index="_internal" source="*license_usage.log" type=Usage st=winlog | bin _time span=1d | stats sum(b) AS bytes by _time,st | eval DailyGB=round (bytes/1024/1024/1024, 3) | timechart sum(DailyGB) by st span=1d limit=0 |sort - _time

So how to modify the same query i.e. I want to additionally include the EventCode=4688 so that it will calculate and pull the exact license usage for the sourcetype=winlog & EventCode=4688.

So kindly help with the query.

Also when i ran the query which you have provided for last 7 days.

index=wineventlog sourcetype=winlog EventCode=4688 earliest=-24h latest=now
| eval bytes=len(_raw)
| stats avg(bytes) as avg_bytes count
| eval ratio=x
| eval consumptionBytes=((avg_bytes*count)*ratio)
| eval consumptionKB=((avg_bytes*count)*ratio)/1024
| eval consumptionMB=((avg_bytes*count)*ratio)/1024/1024
| eval consumptionGB=((avg_bytes*count)*ratio)/1024/1024/1024

I can see two fields in the stats avg_bytes and count.

But I want the daily license usage stats for the sourcetype=winlog EventCode=4688 for past 30 days.

So kindly help on the same.

[harishsplunk7]

I am looking to find out the license usage for particular dataset in events. Please let me know if any clue. 

index=aws sourcetype=aws accoutn=123456 

[KHJean]

Hi @harishsplunk7 ,

I’m a Community Moderator in the Splunk Community. 
This question was posted 3 years ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the  visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post.
 

Thank you!

[PickleRick]

1. Usually starting a new thread instead of digging up an old one (possibly posting a link to the old one for reference) yields bigger chance of getting reasonable results.

2. As you've already read, Splunk does measure only general license usage as well as split by index or sourcetype. But not much more. So you have to either count it yourself by measuring the aggregate data size (which can be very costly) or estimate it by sampling as showed in this thread.

3. License measurement might or might not make sense in context of datasets since datasets can be defined in various way. In general - datasets as such don't consume license. Only the events that dataset is based on have already consumed the license. But this is in no way an "exclusive count" - the same events can be used to for example Network Traffic and Network Sessions datamodels. So it's not really clear what you need.