License Usage by Sourcetypes

The following Splunk query will return results for license usage by sourcetype:

index=_internal source="*license_usage.lo*" type=Usage | stats sum(b) as bytes by st | eval Megabytes=bytes/1048576 |eval Megabytes=round(Megabytes,2) | fieldformat Megabytes=tostring(Megabytes,"commas")| rename st as sourcetype | fields - bytes | sort - Megabytes
Share This:
Tagged:

Comments

  1. curiousSplunker

    Do you happen to have a way to modify this search string to add totals and then show each sourcetype with its percentage of the whole?

    Reply
    1. SplunkNinja

      index=_internal source=”*license_usage.lo*” type=Usage
      | stats sum(b) as bytes by st
      | eval Megabytes=bytes/1048576
      | eval Megabytes=round(Megabytes,2)
      | rename st as sourcetype
      | fields – bytes
      | sort – Megabytes
      | eventstats sum(Megabytes) as totalMB
      | eval percent=100*(Megabytes/totalMB)

      Reply

Leave A Comment?