Reporting

Is there a way to get a report on license usage for all indexes per day over X days, regardless of how little data is indexed?

chanmic
New Member

Hi All,

I'd like a report for license usage for all my indexes per day over X days. We have over 30 indexes and when I run the Daily License Usage in search, it only returns 11 or so indexes. Is there a way that I can get a report for all the indexes' usage, regardless of how little data is indexed in it?

Thanks in advance,
Michael

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like this

index=_internal source=*license_usage.log* type=Usage | bucket span=1d _time | stats sum(b) as bytes by _time idx | eval gb=round(bytes/1024/1024/1024,3) | fields - bytes| append [| gentimes start=-1 | addinfo | eval t=mvrange(info_min_time,info_max_time,86400) | table t | mvexpand t | rename t as _time | bucket span=1d _time | eval gb=0 | join type=left max=0 gb [| rest /services/data/indexes | table title | rename title as idx | eval gb=0]] | stats max(gb) as gb by _time idx 
0 Karma

chanmic
New Member

Thanks somesoni2,

With your query, is there a way to add the usage of the liked indexes together?

0 Karma

masonmorales
Influencer

Yes! Take a look at this app: https://splunkbase.splunk.com/app/2678/

It supports exactly what you are talking about. I built it, so if you have any features requests, just comment on here or e-mail me.

0 Karma

pradeepkumarg
Influencer

What is your search for license usage?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...