topic Re: Splunk license usage for Search head in Installation

Splunk license usage for Search head

rdelmark — Tue, 10 Dec 2013 16:54:41 GMT

I have a 50GB splunk license running on a single Splunk Search/indexer server (host=splunkprod), my total usage peaks about 41GB per day, I noticed that the Splunk host (splunkprod) uses about 4GB in 24hr period of my total 41GB used. Why is this so high. When I run a query on the events there are only 2 data sources and 28,530 events in that 24hr period.

As I understand it Splunk licesense only counts against data flowing into splunk over a 24hr period, are there other factors that contribute to this 4GB usage?

Re: Splunk license usage for Search head

lukejadamec — Tue, 10 Dec 2013 17:00:14 GMT

How are you getting the 4GB number?

Re: Splunk license usage for Search head

rdelmark — Mon, 28 Sep 2020 15:27:29 GMT

I am using this query to find measure which hosts are sending the most throughput that counts against our splunk license. It show 1.596GB using a search time of yesterday

host=* index=_internal group="per_host_thruput" | eval mb=kb/1024| stats sum(mb) by series | where ('sum(mb)'>300) |sort by sum

Re: Splunk license usage for Search head

lukejadamec — Tue, 10 Dec 2013 18:13:20 GMT

Your search is counting volume from the Splunk logs, which don't count against your license.

Try this search:

index=_internal source=*license_usage.log type=Usage 
| stats sum(b) as bytes by h 
| eval MB = round(bytes/1024/1024,1)
| fields h MB

Re: Splunk license usage for Search head

rdelmark — Tue, 10 Dec 2013 19:41:46 GMT

My query comes up with 1.596 GB and your query came up to 29MB, we are wondering if the lic usage.log does not track local host monitoring?