Monitoring Splunk

How to get license usage data for a particular index with a breakdown of usage by a field?

jackiewkc
Path Finder

Hi,

Does anyone know how I can query the license usage of a particular index, breakdown by a field?

Basically I have an index called testindex and there is a field in each event called log_type. I would like to know, on a given date, how much indexed data there is in this index, broken down by log_type. I would expect the output to be something like:

log_type1 10G
log_type2 1.5G
log_type3 0.45G
etc.

Any help will be greatly appreciated.

Thanks.

Regards,
Jackie

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

I fear the license usage logs aren't going to be helpful here, so you may need to go brute force:

index=particular | eval length = length(_raw) | timechart span=1d sum(length) by log_type

If you're going to run this more than once it'll be a good idea to summary index the daily data.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

I fear the license usage logs aren't going to be helpful here, so you may need to go brute force:

index=particular | eval length = length(_raw) | timechart span=1d sum(length) by log_type

If you're going to run this more than once it'll be a good idea to summary index the daily data.

martin_mueller
SplunkTrust
SplunkTrust

Technically they are in characters. Convert before the timechart, so something like this:

... | eval length = length(_raw) / 1048576 | ...

to get the length in megacharacters.

jackiewkc
Path Finder

Thanks Martin

0 Karma

jackiewkc
Path Finder

Thanks a lot for the quick reply, I really appreciate it.

0 Karma

jackiewkc
Path Finder

One quick question. The numbers returned from the query you suggested, are they in bit or byte or Mb? I want to have it set to GB, but when I changed sum(length) to sum(length/1024), it didn't work.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...