Installation

How to resolve mismatch in daily license usage vs. actual utilization?

sarwshai
Communicator

I have ran some query for Data coming through all of the forwarders and matched it with actual daily license utilization.

some of the queries are,

  1. index=_internal group=* group=per_host_thruput | bucket _time span=1d|bin _time |eval time=strftime(_time,"%m/%d/%y") | eval kb=(kb/1024/1024) | stats sum(kb) as SUM by time series | xyseries series time SUM |sort -SUM
  2. index="_internal" source="*metrics.log" group="per_host_thruput" | chart sum(kb) by series | sort - sum(kb)

Its weird that results the search are showing is far greater than the actual utilzation, ran it for today accounting all forwarders & the sum shows almost 500Gigs of data where as license utilization is 280+Gigs only.

Is it something wrong with the search or am i missing out something?

Labels (1)
0 Karma
1 Solution

sarwshai
Communicator

Hi @splunker12er, tried your's query but the only host it is showing is license master itself not any other.

However try this query, it gives exact license usage per host along with index, source and sourcetype.

index=_internal [set_local_host] source=license_usage.log type="Usage"
2. | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
3. | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
4. | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
5. |dedup _time host i b s st h idx
6. | bin _time span=1d
7. | stats sum(b) as b values(s) As Source values(st) As sourceType values(idx) As Index values(_time) As Time by h
8. | eval r_GB=b/1024/1024/1024 | convert ctime(Time) timeformat="%m/%d%Y %H:%M:%S %z"
9. |sort -r_GB

Enjoy!!

View solution in original post

sarwshai
Communicator

Hi @splunker12er, tried your's query but the only host it is showing is license master itself not any other.

However try this query, it gives exact license usage per host along with index, source and sourcetype.

index=_internal [set_local_host] source=license_usage.log type="Usage"
2. | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
3. | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
4. | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
5. |dedup _time host i b s st h idx
6. | bin _time span=1d
7. | stats sum(b) as b values(s) As Source values(st) As sourceType values(idx) As Index values(_time) As Time by h
8. | eval r_GB=b/1024/1024/1024 | convert ctime(Time) timeformat="%m/%d%Y %H:%M:%S %z"
9. |sort -r_GB

Enjoy!!

splunker12er
Motivator

Try this query on license master, this gives correct license usage stats per host

index=_internal source=*license_usage.log* type=Usage 
    |  bucket _time span=1d 
    |  stats sum(b) AS volume_bytes by _time host pool i 
    | eval volume_GB=round(volume_bytes/1024/1024/1024,2) 
    | rename i AS indexer_GUID 
    | JOIN indexer_GUID [ | REST /services/licenser/slaves | table title label | rename title AS indexer_GUID| rename label AS indexer_name] 
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...