topic Re: metrics counting against licence usage in All Apps and Add-ons

metrics counting against licence usage

neovest — Fri, 12 Aug 2016 14:23:11 GMT

I have read that the metric log should not count against our usage license and that if it was we are somehow setup wrong. I noticed that we were butting up against our license usage and when I looked at who was using the data I saw our slunk metrics logs in the top 5. I also read that we needed to change the way those logs were being indexed. Can anyone tell me what to change in order to make sure that the metric and usage logs are not counted against my usage license?

Thanks

Re: metrics counting against licence usage

hagjos43 — Fri, 12 Aug 2016 17:44:30 GMT

Run this query. It'll output what is hitting your license.

index=_internal source=*license_usage.log type="Usage" splunk_server=* earliest=-1w@d | eval Date=strftime(_time, "%Y/%m/%d") | eventstats sum(b) as volume by idx, Date | eval MB=round(volume/1024/1024,5)| timechart first(MB) AS volume by idx

Re: metrics counting against licence usage

neovest — Tue, 29 Sep 2020 10:37:45 GMT

Thanks for the reply, I ran the command and this is the output.

_time default fix_data msexchange nagios os perfmon
2016-08-05 2193.37085 22.57836 19.81520 31.72157 3.59491 7.38140
2016-08-06

2016-08-07

2016-08-08

2016-08-09

2016-08-10

2016-08-11 8994.77014 108.25990 9.12393 29.93557 23.23263 7.83752
2016-08-12 6982.62488 337.65538 14.80471 17.33307 8.72202

Not quite sure what to make of the default

Re: metrics counting against licence usage

somesoni2 — Fri, 12 Aug 2016 20:52:10 GMT

The default index is "main" index (or some other index if you've changed the configuration).