SPL
Splunk License Consumption via _introspection
Description
Just sharing a query I found useful lately when licensing dashboards are being silly. Mileage may vary.
1 0
index="_introspection" component="licensing.stack"
| bucket _time span=1d
| stats latest("data.consumption") as dataConsumption latest("data.pools{}.quota") as poolQuota by _time
| eval pctUsed=(dataConsumption/poolQuota * 100)
| timechart span=1d max(pctUsed)
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.