Installation

How do I find which host is using the most data in Splunk 6.2.2 and causing a license violation?

duanehare
New Member

I am using Splunk 6.2.2 and all of a sudden, I am violating my indexing license. When I run the License Usage Report split by Host, the large chunk of data is returned to as the host "OTHER".

Labels (1)
0 Karma

Abilan1
Path Finder

Hi ,

Please try the below one,

index=_internal source=*license_usage.log type=Usage
| stats sum(b) as bytes by h
| eval MB = round(bytes/1024/1024,1)
| fields h MB
| rename h as host

MuS
SplunkTrust
SplunkTrust

Hi duanehare,

run this search, which is basically the same from the license usage report but with added useother=f usenull=f so you no longer have the OTHER group in the time chart:

index=_internal source=*license_usage.log type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st, h, idx   | join _time pool type=outer [search index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(stacksz) AS stacksz by slave, pool, _time | stats max(stacksz) AS stacksz by _time, pool] | stats sum(b) AS bytes_used max(stacksz) AS stacksz by h, _time | timechart span=1d max(eval(round(bytes_used/stacksz*100,2))) by h fixedrange=false useother=f usenull=f

Hope this helps ...

cheers, MuS

duanehare
New Member

I ran this query and it returned 0 events. Suggestions?

0 Karma

MuS
SplunkTrust
SplunkTrust

do you have access to index=_internal ? run this search:

 index=_internal host=indexer source=*license_usage.log type="Usage"

The above search is the one from the License Usage Report, just added the useother=f usenull=f options....

0 Karma

MuS
SplunkTrust
SplunkTrust

ahh just found the error 🙂 remove host=indexer from the search !

0 Karma

MuS
SplunkTrust
SplunkTrust

Just updated the answer and the search

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...