Splunk stats sum license#
Splunk stats sum series#

i found other posts using similar accepted answers with sum(len(_raw) as a 'brute force' way to drill down on sizes. What is splunk licensing counting that does not seem to show up in my indexes? which yields only 14.7gb to 15.66gb per indexer for the SAME index for the SAME day.Īgain, i expected them not to be exactly the same but thought they should be closer than 300%+. index=xyzzy_logs splunk_server=*rtp* | eval leng=len(_raw)/1024/1024/1024 | stats sum(leng) as totalgb by splunk_server | table splunk_server, totalgb It will produce a table like that shown in the following screenshot: There are a few things to notice about these results: The results are sorted against the. yields between 50gb to 53gb per indexer for that ONE index for that ONE day. index=_internal sourcetype=splunkd source=*license_usage.log | eval gb=b/1024/1024/1024 | join i | search serverName=*rtp* idx=xyzzy_logs | stats sum(gb) by serverName idx

Splunk stats sum license#

My query from a Splunk source to get license info.

There are multiple byte count values over the 2-hour search duration and I would simply like to see a table listing the source, destination, and total byte count. To begin, do a simple search of the web logs. If you use an eval expression, the split-by clause is required.

Splunk stats sum series#

You can specify a split-by field, where each distinct value of the split-by field becomes a series in the chart. So let’s look at a simple search command that sums up the number of bytes per IP address from some web logs. A timechart is a statistical aggregation applied to a field to produce a chart, with time used as the X-axis.

I expected the counts to at least be similar. I am looking through my firewall logs and would like to find the total byte count between a single source and a single destination. There are also a number of statistical functions at your disposal, avg (), count (), distinctcount (), median (), perc (), stdev (), sum (), sumsq (), etc.

I compare it to the byte sum of all of the _raw records for that SAME index for the SAME ONE day. In this specific test case, I am comparing the Splunk license usage for ONE index for ONE day. The problem is that the sum counts dont match the counts when compared to Splunk license usage for the index.

I initially tried to drill down using a basic sum(len(_raw) for all index broken down by various other fields. What is stats Stats calculates aggregate statistics over the results set, such as average, count, and sum.

This commands are helpful in calculations like count, max, average, etc. Ok, I am working to trim back some of our indexed data. In most of the complex queries written in splunk stats, eventstats and streamstats commands are widely used.