Splunk Search

Does anyone know a search query to find license usage by fwdType?

kpavan
Path Finder

Hi All,

Need splunk query which should tell how much license is used by forwarder type, since we are planning migrating from UF to HF.

I was able to get the fwdType details by below search, but now need to get usage by the fwdType. Please help on this.
index=_internal source=metrics.log "os=Windows" "fwdType=*" | dedup os,hostname | rename hostname as host | chart count by fwdType

Thanks!

0 Karma

Raghav2384
Motivator

Forwarder sends anything you want it to. Since HF is going to be in scope for you pretty soon, i am assuming you're going to use it for filtering events? Let's say filtered data is set to send data to index=xyz.
Use |dbinspect to get the raw size on disk in MB / 1024 to get amount of raw data on MB which should be ~license usage in GB. Again, if another HF is set to send data to same index, i am not sure at that point. Click on Settings>Licensing>Usage Reports, it should give you some ideas. Not sure if there's a direct way.hope this helps.
thanks,
Raghav

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...