Getting Data In

How to create a summary Index that will give license usage by index and sourcetype?

siva_cg
Path Finder

Hi All,

I am trying to create a summary index which will gives us the license usage by index and sourcetype, which will be used for creating a dashboard with trends based on index and breaches per day. The process followed is

  1. Schedule a saved search with the below query index=_internal type=Usage source="/opt/splunk/var/log/splunk/license_usage.log" |stats sum(b) as bytes by idx, st
  2. Enable Summary Indexing

After that I am using below query to pull out the trend for last 24hrs
index=summary search_name=savedsearch_name |stats sum(bytes) by idx |eval GB = round(bytes/1024/1024/1024, 2)
But the above query gave me wrong results. Could you please help me to sort out the mistake? Thanks in advance.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Since you (might) want to calculate trends, your summary index needs _time field and a smaller, evenly distributed summary indexing frequency. I would do something like this

Summary index search name: license_usage_5min_summary
Search:

index=_internal sourcetype=splunkd component=LicenseUsage type=Usage | bucket span=5m _time | stats sum(b) as bytes by _time idx st

Time range: -9m@m to -4m@m (allowing 4min delay to account for indexing delay
Cron Schedule : 4-59/5 * * * * (every 5 mins, starting at 4th min. Since we take a 4 min delay, your data will collected for even time blocks 0-5 mins, 5-10min etc)

You can backfill it for past period using this method: https://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/Managesummaryindexgapsandoverlaps#Use_t...

Now use new summary index data for your trending. Since this has correct _time value it'll honor time-range as well.

0 Karma

ddrillic
Ultra Champion

@somesoni2 - it's interesting that in the admin class they try to stir us from summary indexes towards data model accelerations.

0 Karma

somesoni2
SplunkTrust
SplunkTrust
0 Karma

deepashri_123
Motivator

Hey@siva_cg

You can already find the trend of license usage by index on the license master for 30 days in the usage report.
Is there any specific reason to use summary index?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...