About jkeRE

jkeRE · ‎12-11-2012

I found it!!! Thank you very much. /opt/splunk/bin/splunk search "index=_internal source=*license_usage.log type=Usage earliest=-1d@d latest=-0d@d | eval MB=b/1024/1034 | stats sum(MB) by h | sort sum(MB) | reverse" -auth test:test123

jkeRE · ‎12-11-2012

Thanx, this work !! And what have i apend that the result is sort by most volume first?

jkeRE · ‎12-11-2012

Hello, what is wrong: /opt/splunk/bin/splunk search "index=_internal source=*license_usage.log type=Usage | earliest=-1d@d | eval GB=b/1024/1024/1024 | stats sum(GB) by h | reverse" -auth test:test123 Unknown search command 'earliest'.

jkeRE · ‎12-11-2012

THX, i have already read this, but didn't find a solution. I use this CLI --> /opt/splunk/bin/splunk search "index=internal source=*licenseusage.log type=Usage | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by h useother=false" -auth test:test123 My Problem is that - the output only has the first 10 Hosts --> (limits.conf --> maxseries = 200 ) - and the output is very long. i want to limit to the last day. Have you a solution?

jkeRE · ‎12-11-2012

Hello, i am searching for a CLI Search Command which gives me the result of the daily Indexed volume per Host. Which is the same as i do it via the GUI / Browser --> Splunk --> Status --> Index activity --> Indexing Volume --> Split by Host / Yesterday THX J.

Posts	5
Solutions	1
Karma Given	3
Karma Received	2
Member Since	‎12-11-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Index volume by host

Re: Index volume by host

Re: Index volume by host

Re: Index volume by host

Re: Index volume by host

Index volume by host