Difference between Splunk License report and index usage?

[gerstnc]

Trying to evaluate our license model, planning for future.
We have the 100G/day license and a promo 100G/day license for a total of 200G/day.

Looking at our license report, we're using around 70G/day.
Checking the index usage page, we're showing around 120G/day usage.

I'm not sure the difference between the 2 and which is more accurate for our planning needs.
If we're indexing 130/G per day, why does our license report showing us using nowhere near this amount?

[chrisyounger]

Hi @gerstnc

I would trust the license report for this. The metrics.log includes other things like _internal indexes which are not charged. It also shows the metrics.log reports from universal forwarders. So be sure to limit your query to just host = <indexers>*

Hope this helps