SPL
License Usage by Sourcetypes
Description
The following Splunk query will return results for license usage by sourcetype:
9 0
index=_internal source="*license_usage.lo*" type=Usage | stats sum(b) as bytes by st | eval Megabytes=bytes/1048576 |eval Megabytes=round(Megabytes,2) | fieldformat Megabytes=tostring(Megabytes,"commas")| rename st as sourcetype | fields - bytes | sort - Megabytes
Comments
3 total
Do you happen to have a way to modify this search string to add totals and then show each sourcetype with its percentage of the whole?
index=_internal source=\"*license_usage.lo*\" type=Usage \r\n| stats sum(b) as bytes by st \r\n| eval Megabytes=bytes/1048576 \r\n| eval Megabytes=round(Megabytes,2) \r\n| rename st as sourcetype \r\n| fields - bytes \r\n| sort - Megabytes\r\n| eventstats sum(Megabytes) as totalMB\r\n| eval percent=100*(Megabytes/totalMB)
You rock friend! Thanks a bunch!
Leave a comment
You must log in to post a comment.