Splunk Search

How to search the license usage per index per department?

arjangoos
Path Finder

I want the license usages per index per department.

department 1 has indexes:

idx             volume
acc_jboss       100
prod_jboss      150
test_jboss      50

department 1 volume is 300

department 2 has indexes

idx             volume
prod_network    1000
acc_network     509
test_network    100

department 2 volume is 1609

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Step 1: Create a lookup table file, say dept_index_lookup.csv with field department,index

department,index
...................................
dept1,acc_jboss
dept1,prod_jboss
dept1,test_jboss
dept2,prod_network
dept2,acc_network
dept2,test_network

Step 2 : Search License usage search like this

index=_internal source=*license_usage.log type=usage | stats sum(b) as usageGB by idx | eval usageGB=round(usage/1024/1024/1024,2)  | rename idx as index | lookup dept_index_lookup.csv index OUTPUT department | table department index usageGB
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...