Alerting

How to measure the license consume from a list of events

corti77
Communicator

Hi,

I am trying to fine tune our license consumption and I can easily check the total number of events that match certain criteria (e.g: certain windows event ID for example).  but how could I check the license consume by them? in other words, the total size of the data set of a query.

doing this, I could decide to blacklist certain events knowing beforehand that this blacklist will save X amount of MB a day of license.

cheers,

Jose

Labels (1)
0 Karma

corti77
Communicator

hi Giuseppe,

unfortunately I cannot consult the license consumption as my splunk instance is dependent of a master instance managed by another institution. that is why I was wondering if I could make my own calculation , even though it is not 100% accurate.

maybe using something like 

index=wineventlog EventCode=4689 | eval raw_length=len(_raw) 
| stats sum(raw_length) as totalSize
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @corti77,

yes it should run, even if not accurate.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @corti77,

the calculation of consumed license is in the _internal index (as you can see in the License consuption Report [Settings -- Licenses -- License Consuption -- last 60 days]).

So it isn't so easy correlate this earch with a normal search.

My hint is to:

  • understand, using the above search, what's the most heavy sourcetype.
  • then run a search on that sourcetype finding the most numerous EventCodes.
  • Then you can decide to filter the ones of them that you don't want.

In this way you could do a percentage calculation of how many MB you save with this filter.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...