All Apps and Add-ons

Difference between Splunk License report and index usage?

New Member

Trying to evaluate our license model, planning for future.
We have the 100G/day license and a promo 100G/day license for a total of 200G/day.

Looking at our license report, we're using around 70G/day.
Checking the index usage page, we're showing around 120G/day usage.

I'm not sure the difference between the 2 and which is more accurate for our planning needs.
If we're indexing 130/G per day, why does our license report showing us using nowhere near this amount?

alt text

Tags (1)
0 Karma


Hi @gerstnc

I would trust the license report for this. The metrics.log includes other things like _internal indexes which are not charged. It also shows the metrics.log reports from universal forwarders. So be sure to limit your query to just host = <indexers>*

Hope this helps

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...