https://community.splunk.com/t5/Deployment-Architecture/Volume-used/m-p/232043#M23815 <P>Hi Everyone. I recently installed the free version of Splunk. I have configured it to read data from only one data source, Netflow from a single router. Over the last 5 days, only 7MB of Netflow data has been collected. However, the volume used in the licensing is showing that I have used 3GB so far today. Can anyone shed some light as to why this is possibly happening? </P> <P>Thanks,<BR /> Matt</P> Mon, 21 Sep 2015 07:51:28 GMT itionet 2015-09-21T07:51:28Z https://community.splunk.com/t5/Deployment-Architecture/Volume-used/m-p/232043#M23815 <P>Hi Everyone. I recently installed the free version of Splunk. I have configured it to read data from only one data source, Netflow from a single router. Over the last 5 days, only 7MB of Netflow data has been collected. However, the volume used in the licensing is showing that I have used 3GB so far today. Can anyone shed some light as to why this is possibly happening? </P> <P>Thanks,<BR /> Matt</P> Mon, 21 Sep 2015 07:51:28 GMT https://community.splunk.com/t5/Deployment-Architecture/Volume-used/m-p/232043#M23815 itionet 2015-09-21T07:51:28Z https://community.splunk.com/t5/Deployment-Architecture/Volume-used/m-p/232044#M23816 <P>Run following query and you can check the license usage by index. Based on this you can get to know where your license capacity is utilized.</P> <PRE><CODE>index=_internal source=*license_usage.log sourcetype=splunkd | timechart span=1d sum(b) as bytes by idx limit=0| eval MB=round(bytes/1024/1024/1024,3) </CODE></PRE> <P>Other variation your can try is using the sourcetype</P> <PRE><CODE>index=_internal source=*license_usage.log sourcetype=splunkd | timechart span=1d sum(b) as bytes by st limit=0| eval MB=round(bytes/1024/1024/1024,3) </CODE></PRE> Mon, 21 Sep 2015 19:52:25 GMT https://community.splunk.com/t5/Deployment-Architecture/Volume-used/m-p/232044#M23816 somesoni2 2015-09-21T19:52:25Z