https://community.splunk.com/t5/Monitoring-Splunk/Splunk-license-calculations/m-p/105314#M7507 <P>We have hit our limit and I am trying to work out the source of the overage.</P> <P>For today if I run</P> <P>index="_internal" source="*metrics.log" per_index_thruput | timechart<BR /> span=1d sum(kb) by series</P> <P>The sum total don't make sense to me,</P> <P>It gives 35.30685103 GB and splunk is reporting 17,035 MB indexed, when I look at the license information.</P> <P>How do I get an accurate report that tells me what has been indexed, verse what splunk counts as indexed data.</P> Mon, 28 Sep 2020 10:03:52 GMT imacdonald2 2020-09-28T10:03:52Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-license-calculations/m-p/105314#M7507 <P>We have hit our limit and I am trying to work out the source of the overage.</P> <P>For today if I run</P> <P>index="_internal" source="*metrics.log" per_index_thruput | timechart<BR /> span=1d sum(kb) by series</P> <P>The sum total don't make sense to me,</P> <P>It gives 35.30685103 GB and splunk is reporting 17,035 MB indexed, when I look at the license information.</P> <P>How do I get an accurate report that tells me what has been indexed, verse what splunk counts as indexed data.</P> Mon, 28 Sep 2020 10:03:52 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-license-calculations/m-p/105314#M7507 imacdonald2 2020-09-28T10:03:52Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-license-calculations/m-p/105315#M7508 <P>Looks like the way to calculate the numbers has changed in 4.2</P> <P>The following is giving me better numbers.</P> <P>index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by st useother=0</P> Mon, 28 Sep 2020 10:03:55 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-license-calculations/m-p/105315#M7508 imacdonald2 2020-09-28T10:03:55Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-license-calculations/m-p/105316#M7509 <P>See also <A href="http://splunk-base.splunk.com/answers/33773/send-alert-when-indexing-volume-limit-exceeded">http://splunk-base.splunk.com/answers/33773/send-alert-when-indexing-volume-limit-exceeded</A></P> Mon, 07 Nov 2011 20:49:39 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-license-calculations/m-p/105316#M7509 ChrisG 2011-11-07T20:49:39Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-license-calculations/m-p/105317#M7510 <P>Check my answer to the question above along with my blog post I linked to in the answer.. there may be a few searches there that will appeal to you to track down the issue.</P> Mon, 07 Nov 2011 20:52:10 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-license-calculations/m-p/105317#M7510 joshd 2011-11-07T20:52:10Z