Hi,
I am trying to fine tune our license consumption and I can easily check the total number of events that match certain criteria (e.g: certain windows event ID for example). but how could I check the license consume by them? in other words, the total size of the data set of a query.
doing this, I could decide to blacklist certain events knowing beforehand that this blacklist will save X amount of MB a day of license.
cheers,
Jose
hi Giuseppe,
unfortunately I cannot consult the license consumption as my splunk instance is dependent of a master instance managed by another institution. that is why I was wondering if I could make my own calculation , even though it is not 100% accurate.
maybe using something like
index=wineventlog EventCode=4689 | eval raw_length=len(_raw)
| stats sum(raw_length) as totalSize
Hi @corti77,
the calculation of consumed license is in the _internal index (as you can see in the License consuption Report [Settings -- Licenses -- License Consuption -- last 60 days]).
So it isn't so easy correlate this earch with a normal search.
My hint is to:
In this way you could do a percentage calculation of how many MB you save with this filter.
Ciao.
Giuseppe