https://community.splunk.com/t5/Security/license-violation/m-p/34210#M13765 <P>using the Splunk License Usage App to get breakdown of index usage by index,host,source,sourcetype<BR /> however what i would really like is usage by event_type. I'm assuming one of the reasons my index are large on the above items is because the users have setup event_type rules that are to generic and by making the rules more specific i csn cut down on index volume? Am i looking at this correctly? I'm new to splunk so please forgive the ignorance</P> Mon, 28 Sep 2020 11:42:47 GMT edwinbmiller 2020-09-28T11:42:47Z https://community.splunk.com/t5/Security/license-violation/m-p/34210#M13765 <P>using the Splunk License Usage App to get breakdown of index usage by index,host,source,sourcetype<BR /> however what i would really like is usage by event_type. I'm assuming one of the reasons my index are large on the above items is because the users have setup event_type rules that are to generic and by making the rules more specific i csn cut down on index volume? Am i looking at this correctly? I'm new to splunk so please forgive the ignorance</P> Mon, 28 Sep 2020 11:42:47 GMT https://community.splunk.com/t5/Security/license-violation/m-p/34210#M13765 edwinbmiller 2020-09-28T11:42:47Z https://community.splunk.com/t5/Security/license-violation/m-p/34211#M13766 <P>Event type rules (eventtypes.conf) are done at search time, and don't count against your indexing limit. The licensing usage only applies to <EM>raw</EM> data coming in from your log sources. If you are collecting from a large number of hosts, or large number of files, you can do searches like:</P> <P><CODE>| metadata type=hosts</CODE> OR <CODE>| metadata type=sources</CODE></P> <P>The number shown in the "events" column is the number of log events from that host (or input file). This can help to identify "noisy" hosts. You could then do a search for that host (again, or logfile) to look at the log events, to then see the contents of that log data.</P> Tue, 24 Apr 2012 14:35:28 GMT https://community.splunk.com/t5/Security/license-violation/m-p/34211#M13766 sowings 2012-04-24T14:35:28Z https://community.splunk.com/t5/Security/license-violation/m-p/34212#M13767 <P>thanks for the clarification, so the only way to reduce usage is reduce the rate of syslogs entries being generated by chatty hosts?<BR /> It would be great if there was a way to discard unwanted syslog or other data source entries so they would not be counted against the license.<BR /> After all why should i pay for data i don't even need.<BR /> Often filtering output directly from a source is hard.</P> Wed, 25 Apr 2012 01:58:58 GMT https://community.splunk.com/t5/Security/license-violation/m-p/34212#M13767 edwinbmiller 2012-04-25T01:58:58Z https://community.splunk.com/t5/Security/license-violation/m-p/34213#M13768 <P>You can filter out specific events (be careful that the regex is not too general!) by using the nullQueue. There are some tips <A href="http://splunk-base.splunk.com/answers/9293/problem-routing-events-to-nullqueue">here</A>.</P> Wed, 25 Apr 2012 02:07:10 GMT https://community.splunk.com/t5/Security/license-violation/m-p/34213#M13768 sowings 2012-04-25T02:07:10Z