How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

[lwaddep1]

How to generate a search to find license usage for a particular index for past 7 days sorted by host and source?

Particular indexer is pumping lot of data recently, we want to have a report for the index by host and source for the past 7 days.

[somesoni2 · Accepted solution]

Try this

index=_internal sourcetype=splunkd source=*license_usage.log type=Usage idx=YourIndexNameHere
| eval host=coalesce(h,"<<SQUASHED>>") | eval source=coalesce(s,"<<SQUASHED>>")
| stats sum(b) as usage by host source
| eval usageMB=round(usage/1024/1024,3)

[traxxasbreaker]

Just want to note that this search will only show an accurate breakdown by source if your combination of indexes, sourcetype, sources, and hosts is below the "squashing threshold". Index and sourcetype are guaranteed to remain accurate with a large number of combinations but the others are not. See this answer for some more details.

[lwaddep1]

Thanks for your response, i verified query it worked for past 7 days of usage. I want to break this per day for last 7 days. how can i do it?

[lwaddep1]

what changes does it need if we want to capture the same data in a timechart ?

[lwaddep1]

Thanks for the quick response, appreciate your help.

[somesoni2]

Like this

 index=_internal sourcetype=splunkd source=*license_usage.log type=Usage idx=YourIndexNameHere
| bucket span=1d _time
 | eval host=coalesce(h,"<<SQUASHED>>") | eval source=coalesce(s,"<<SQUASHED>>")
 | stats sum(b) as usage by _time host source
 | eval usageMB=round(usage/1024/1024,3)