Comments

1. itgeektech March 30, 2018 at 5:16 pm

   Thank you so much this is awsome

   Reply
2. Samthegeek August 21, 2018 at 10:03 am

   index=_internal source=*license_usage.log type=”Usage” splunk_server=* earliest=-1w@d | eval Date=strftime(_time, “%Y/%m/%d”) | eventstats sum(b) as volume by idx, Date | eval GB=round(volume/1024/1024,5)| timechart first(GB) AS volume by idx

   I tried to modify this search to use GB (gigabyte instead of MB megabyte) but the numbers did not change so I am guessing I missed something. I am using a last 7 day window for the search. Can someone please point me in the right direction. thanks.

   Reply
   1. SplunkNinja August 21, 2018 at 9:44 pm

      Samthegeek,
      You’ll want to add in the additional math for GB.
      | eval MB=round(volume/1024/1024,5)
      | eval MB=round(volume/1024/1024/1024,5)

      As you can see above you simply divide by another 1024 to go from MB to GB.

      Thanks!

      Reply
3. Samthegeek August 22, 2018 at 10:38 am

   | eval MB=round(volume/1024/1024,5)
   | eval GB=round(volume/1024/1024/1024,5)

   Would it be GB in the second statement? thank you for the advice.

   Reply
4. donbabs May 3, 2019 at 12:17 pm

   Yes but the search does not work on my system.

   Reply
5. Speed Racer May 29, 2019 at 4:35 pm

   Thx for the great search. You mentioned that the search will also output an average for each index over the course of the given time period, but I’m not seeing an average after the search completes.

   Thx

   Reply
   1. SplunkNinja June 12, 2019 at 10:20 pm

      Speed Racer,
      Good catch. I think an earlier version of this did have an average but was removed for some reason.

      You’d want to use something like this below but alter it as needed:
      index=_internal source=*license_usage.log type=”Usage” splunk_server=*
      | eval Date=strftime(_time, “%Y/%m/%d”)
      | streamstats sum(b) as volume
      | eval MB=round(volume/1024/1024,5)
      | timechart span=1w avg(MB) by idx

      Reply
6. AzJimbo September 19, 2020 at 6:30 am

   Bummer – this doesn’t work with my dev license. So I built a workaround. I can get daily usage, but not over time. So this runs every night just before the data rolls over and is lost:
   59 22 * * * Sooner or later I’ll have to add a data roll off to the csv based on date collected.

   |inputlookup license_tracking.csv append=true
   |append
   [| rest splunk_server=local /services/licenser/pools
   | rename title AS Pool
   | search
   [ rest splunk_server=local /services/licenser/groups
   | search is_active=1
   | eval stack_id=stack_ids
   | fields stack_id]
   | eval quota=if(isnull(effective_quota),quota,effective_quota)
   | eval “Used”=round(used_bytes/1024/1024/1024, 3)
   | eval “Quota”=round(quota/1024/1024/1024, 3)
   | eval “% used”=round(used_bytes/quota*100,2)
   | fields Pool “Used” “% used” “Quota”
   |eval dtger=(now())
   |eval dtgr=strftime(dtger, “%Y-%m-%d %H:%M:%S”)
   ]
   |table dtger dtgr Pool “Used” “% used” “Quota”
   |outputlookup license_tracking.csv

   Reply