Splunk Search

How to restrict license report to slaves via lookup?

a212830
Champion

Hi,

I want to run reports against certain slaves reporting into the license manager, and filter them via a lookup. Here's the existing search - is there a way to filter them via lookup and slave name (not guid) ?

index=_internal source=*license_usage.log type="RolloverSummary"   | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | eval slave_guid=slave | stats max(b) AS volume by slave_guid, _time  | join type=outer slave_guid [rest splunk_server=local /services/licenser/slaves | rename label AS slave_name title AS slave_guid | table slave_guid slave_name] | eval slave_name = if(isnotnull(slave_name),slave_name,"GUID: ".slave_guid) | timechart span=1d max(volume) AS "volume" by slave_name fixedrange=false limit=1000| join type=outer _time [search index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(stacksz) AS "stack size" by _time] | fields - _timediff  | foreach * [eval <>=round('<>'/1024/1024/1024, 3)]
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

1) Run following search to generate a lookup with all license slaves and corresponding GUID. I would create a scheduled saved search to get this lookup table (say license_slaves.csv) updated daily.

 | rest splunk_server=local /services/licenser/slaves | rename label AS slave_name title AS slave_guid | table slave_guid slave_name | outputlookup license_slaves.csv

2) Update your dashboard like this

a) add the data input (multiselect) to use the lookup

<input type="multiselect" token="slaves">
      <label>License Slaves</label>
      <choice value="*">All Slaves</choice>
      <search>
        <query>| inputlookup license_slaves.csv | table slave_guid slave_name</query>
      </search>
      <fieldForLabel>slave_name</fieldForLabel>
      <fieldForValue>slave_guid</fieldForValue>
      <default>*</default>
      <prefix>slave=</prefix>
      <delimiter> OR slave=</delimiter>
    </input>

b) Update you dashboard search like this
Updated

index=_internal source=*license_usage.log type="RolloverSummary" $slaves$ | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | stats max(b) AS volume by slave, _time | lookup license_slaves.csv slave_guid as slave OUTPUT slave_name  | eval slave_name = if(isnotnull(slave_name),slave_name,"GUID: ".slave) | timechart span=1d max(volume) AS "volume" by slave_name fixedrange=false limit=1000| join type=outer _time [search index=_internal source=license_usage.log type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(stacksz) AS "stack size" by _time] | fields - _timediff | foreach  * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]
0 Karma

a212830
Champion

Thanks - give me: Mismatched ']'.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Missed removing a bracket. Try the updated answer now.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...