Splunk Search

Why would a bucket/bin be set to a one day span on the License Master?

pkeller
Contributor

Looking at the Daily License Usage panel on the "Previous 30 Days" tab under Licensing, I see that the base search is:

index=_internal [set_local_host] source=license_usage.log type="RolloverSummary" earliest=-30d@d
| eval _time=_time - 43200
| bin _time span=1d
| stats latest(b) AS b latest(stacksz) AS stacksz by slave, pool, _time
| stats sum(b) AS volumeB max(stacksz) AS stacksz by _time
| eval pctused=round(volumeB/stacksz*100,2)
| timechart span=1d max(pctused) AS "% used" fixedrange=false

What is the idea behind setting _time 1/2 day behind?

Thank you.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The rollover summary is (and can be) generated after the whole day is passed. It's just an adjustment to ensure correct rollover summary is selected for that day (summary generated today will be for yesterday).

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The rollover summary is (and can be) generated after the whole day is passed. It's just an adjustment to ensure correct rollover summary is selected for that day (summary generated today will be for yesterday).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...