topic Re: How to check the total consumption out of the 500MB provided by free splunk? in Splunk Search

How to check the total consumption out of the 500MB provided by free splunk?

hishamjan — Thu, 18 Feb 2021 08:56:47 GMT

Hi,

In my production environment, I have two Asterisk Servers installed where one of them caters to 95% of the data while the other caters only 5%.

I successfully installed Splunk Universal Forwarders on my two Asterisks and was able to index data from the 5% server. Now, I want to index similar data from the 95% server as well but, I'm not sure how much quota has been consumed so far out of the 500MB and indexing the 95% server might exceed the limit.

Is there a way to figure out how much out of the 500MB is used and how much Is left?

Any help will be appreciated.

Re: How to check the total consumption out of the 500MB provided by free splunk?

aasabatini — Thu, 18 Feb 2021 09:15:53 GMT

Hi,

you can check on the menu settings under the voice licensing.

Or you can check the consumption by this search:

1	index=_internal source=license_usage.log type="Usage" splunk_server= earliest=-1w@d \| eval Date=strftime(_time, "%Y/%m/%d") \| eventstats sum(b) as volume by idx, Date \| eval MB=round(volume/1024/1024,5)\| timechart first(MB) AS volume by idx

Re: How to check the total consumption out of the 500MB provided by free splunk?

hishamjan — Thu, 18 Feb 2021 09:44:38 GMT

Hi,

Thank you for your reply. This somewhat answers my question because this query you just shared is showing me the percentage of data consumed by the Indexer itself and not by the Forwarder (95% and 5%) servers.

The Licensing also shows the data consumed today by the indexer as well only.

I'd like to see the data consumed by the forwarders, for now, can we achieve that as well?

Thanks.

Re: How to check the total consumption out of the 500MB provided by free splunk?

aasabatini — Thu, 18 Feb 2021 10:34:21 GMT

Try this

index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | stats sum(GB) by h | sort -sum(GB)

Re: How to check the total consumption out of the 500MB provided by free splunk?

hishamjan — Thu, 18 Feb 2021 12:38:56 GMT

These are supposed to be added right? Otherwise, it seems as if it is 500MB per h which doesn't make sense to me..

Re: How to check the total consumption out of the 500MB provided by free splunk?

aasabatini — Thu, 18 Feb 2021 12:48:36 GMT

Sorry but I don't understand your point.

you have 500Mb free license for all the forwarders, the search show you the license consumption by forwarder, if you sum your values you have a total of less than 300 Mb.

Re: How to check the total consumption out of the 500MB provided by free splunk?

hishamjan — Thu, 18 Feb 2021 13:01:35 GMT

Thanks a lot, I've got your point