topic Too many indexed bytes reported in Installation

Too many indexed bytes reported

rschutt — Mon, 28 Sep 2020 10:16:34 GMT

I'm running the following search:

index="_internal" source="*license_usage.log"

The problem is that all hosts report received bytes, eventhough there are no events received. The lowest number I have seen is 134 bytes (b=134). Does anyone know why I see these and how I can report on the real number of indexed bytes? Thanks!

Re: Too many indexed bytes reported

joshd — Wed, 04 Jan 2012 16:18:40 GMT

I've listed some searches on my blog to show the license breakdown by source, sourcetype, host, per index statistics and so on... I would start with running these various searches to narrow down where the actual culprit is...

http://www.joshd.ca/content/splunk-usage-statistic-searches

I would also suggest downloading and using the Splunk Deployment Monitor app as it can provide a wealth of information:

http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor

Re: Too many indexed bytes reported

yannK — Wed, 04 Jan 2012 18:54:52 GMT

you need to group per source sourcetype host indexer, (s/h/st/i) to have useful numbers.
You can check the examples of searches on license_usage there :
http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume

Re: Too many indexed bytes reported

rschutt — Mon, 28 Sep 2020 10:17:00 GMT

The strange thing is that I tested the same on another deployment and on this I won't get any of these entries in license_usage.log if no events occur, which is what I expected. On the initial deployment I see every minute a new event in license_usage.log with "h" being my forwarder and "b" always showing at least 134 bytes, eventhough I cannot find any events from this forwarder. So where are these bytes going? I should see them in any of the non-internal indexes, right?