How to get a license report with sourcetypes and indexes?

[a212830]

Hi,

I need a license report for sourcetypes that also shows the relevant index. Is that possible?

[javiergn · Accepted solution]

Try this:

index=_internal source=*license_usage.log type="Usage" 
| eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| eval sourcetypename = st
| bin _time span=1d 
| stats sum(b) as b by _time, pool, indexname, sourcetypename
| eval GB=round(b/1024/1024/1024, 3)
| fields _time, indexname, sourcetypename, GB

[sloshburch]

For posterity, the newer versions (6+?) of splunk include fields for the index, host, source, and sourcetype in the license_usage.log file. They are i,h,s,st, respectively (I believe).

[a212830]

Fantastic! Thanks.

And of course, now I'm being asked to include host. Is that possible?

[a212830]

Never mind. figured it out. Thanks.