License Overview
Split-by
Internal_Log_Events.idx
Index
Sourcetype
Host

This dashboard is intended to show the overall status of license utilization across the different Splunk servers and data types.

The dashboard provides a high level overview of overall license used today, by index, and trending over time by index/environment option. To gain deeper insights into Splunk's license and data volume consumption reference eitherFireBrigadeorS.o.S Splunk on Splunk.

# Todays Overall License Usage (GB)

| tstats summariesonly=false sum(Internal_Log_Events.b) AS bytes from datamodel="Internal_Events" GROUPBY Internal_Log_Events.idx | eval gb=round(bytes/1024/1024/1024,2) | stats sum(gb) AS "Total GB"
@d
now
visible
visible
linear
linear
fillerGauge
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
["0","2","6","10"]
[0x84E900,0xFFE800,0xBF3030]
ellipsisNone
0
visible
false
inherit
50
10
area

# Total GB Ingested Today

| tstats summariesonly=false sum(Internal_Log_Events.b) AS bytes from datamodel="Internal_Events" WHERE [inputlookup all_servers.csv | search role=indexer | rename guid AS "Internal_Log_Events.i"| fields Internal_Log_Events.i] GROUPBY $type$ | eval gb=round(bytes/1024/1024/1024,2) | stats sum(gb) AS "Total GB" by $type$ | rename Internal_Log_Events.idx AS Index Internal_Log_Events.st AS "Source Type" Internal_Log_Events.h AS Host | sort - "Total GB"
@d
now
full
1
5
full
false
1
1
list
true
none
cell
10

# Week on Week Usage - Current Day is Partial

| tstats summariesonly=true sum(Internal_Log_Events.b) AS bytes from datamodel="Internal_Events" WHERE [inputlookup all_servers.csv | search role=indexer | rename guid AS "Internal_Log_Events.i"| fields Internal_Log_Events.i] GROUPBY _time | eval marker=case( _time < relative_time(now(), "-1w@w"), "Two Weeks Ago", _time < relative_time(now(), "@w"), "Last Week", true(), "This Week") | eval _time=case( _time < relative_time(now(), "-1w@w"), _time+2*7*86400, _time < relative_time(now(), "@w"), _time+7*86400, true(), _time) | eval gb=bytes / 1024 / 1024 / 1024 | chart sum(gb) AS gbytes OVER _time BY marker | fieldformat _time=strftime(_time, "%A")
-2w@w
now
visible
visible
linear
linear
line
gaps
0.01
stacked
shiny
all
0
ellipsisMiddle
bottom
GB Indexed
Time
ellipsisNone
0
visible
false
inherit
50
10
area
@d
now

# License Usage (GB)

| tstats summariesonly=false sum(Internal_Log_Events.b) AS bytes from datamodel="Internal_Events" WHERE [inputlookup all_servers.csv | search role=indexer | rename guid AS "Internal_Log_Events.i"| fields Internal_Log_Events.i] GROUPBY _time $type$ span=auto | eval gb=bytes/1024/1024/1024 | timechart sum(gb) by $type$
visible
visible
linear
linear
column
gaps
0.01
stacked
shiny
all
0
ellipsisMiddle
right
ellipsisNone
0
visible
false
inherit
Time
50
10
area

# Todays Overall Ingestion by Index/Indexer (GB)

|tstats summariesonly=false sum(Internal_Log_Events.b) AS bytes from datamodel="Internal_Events" WHERE [inputlookup all_servers.csv | search role=indexer | rename guid AS "Internal_Log_Events.i"| fields Internal_Log_Events.i] GROUPBY _time $type$ Internal_Log_Events.i span=auto | eval gb=round(bytes/1024/1024/1024,2) | lookup all_servers.csv guid AS "Internal_Log_Events.i" OUTPUTNEW host | chart sum(gb) over host by $type$
@d
now
ellipsisNone
-90
visible
GB
visible
visible
linear
linear
false
log
column
gaps
0.01
stacked
shiny
all
0
ellipsisMiddle
right
50
10
area
Splunk Indexing Limit
250
-7d@h
now

# Data Distribution by Indexer

| tstats prestats=t count WHERE index=* [|inputlookup all_servers.csv | search role=*indexer* | rename host AS splunk_server | fields splunk_server ] BY splunk_server, _time span=1d | timechart limit=100 span=1d count by splunk_server
$field1.earliest$
$field1.latest$
$field1.earliest$
$field1.latest$
$field1.earliest$
$field1.latest$
column
false
ellipsisNone
0
Time
visible
Events
visible
visible
linear
linear
inherit
50
10
area
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right

# Event Count Ingested by Indexing Delay(s) - Today

| tstats count max(_time) as t max(_indextime) as it where index=* by _time | eval delay=it-t | timechart sum(count) avg(delay) as delay(s)
@d
now
column
true
ellipsisNone
0
visible
visible
visible
linear
linear
inherit
50
10
area
gaps
delay(s)
0.01
default
shiny
all
0
ellipsisMiddle
right
Time
Events

# Matrix Overview - Index Capacity/Usage

| rest /services/data/indexes search="totalEventCount!=0" | eval coldPath.maxDataSizeMB=if('coldPath.maxDataSizeMB' = 0, null(), 'coldPath.maxDataSizeMB') | eval homePath.maxDataSizeMB=if('homePath.maxDataSizeMB' = 0, null(), 'homePath.maxDataSizeMB') | eval roof=min((coalesce('homePath.maxDataSizeMB', 4294967295) + coalesce('coldPath.maxDataSizeMB', 4294967295)), maxTotalDataSizeMB) | eval span=tostring(currentDBSizeMB) + " / " + tostring(roof) + " MB" | eval Percent=tostring(round(currentDBSizeMB * 100 / roof)) + "%"| search [inputlookup all_servers.csv | search role=indexer | rename host AS splunk_server | fields splunk_server] | stats first(span) AS "Capacity vs Limit" by splunk_server title minTime maxTime Percent | rename splunk_server AS Indexer title AS Index minTime AS "Oldest Event" maxTime AS "Newest Event" | table Indexer Index "Capacity vs Limit" "Oldest Event" "Newest Event" Percent | sort - Percent
0
now
true
false
none
100
none

# Disk Usage

| tstats max(Introspection.Disk_Objects.Capacity) AS Capacity max(Introspection.Disk_Objects.Avail) AS Avail max(Introspection.Disk_Objects.Used) AS Used max(Introspection.Disk_Objects.UsedPct) AS UsedPct FROM datamodel=Introspection_Usage WHERE nodename=Introspection.Disk_Objects [inputlookup all_servers.csv | fields host] GROUPBY _time host Introspection.data.mount_point | eventstats max(_time) AS latest by host | where _time=latest | lookup all_servers.csv host OUTPUT role | rename Introspection.data.mount_point AS Mount role AS Role |table host Role Mount Capacity Avail Used UsedPct | sort - UsedPct
@d
now
true
false
none
none
100