All Apps and Add-ons

Difference between Splunk License report and index usage?

New Member

Trying to evaluate our license model, planning for future.
We have the 100G/day license and a promo 100G/day license for a total of 200G/day.

Looking at our license report, we're using around 70G/day.
Checking the index usage page, we're showing around 120G/day usage.

I'm not sure the difference between the 2 and which is more accurate for our planning needs.
If we're indexing 130/G per day, why does our license report showing us using nowhere near this amount?

alt text

Tags (1)
0 Karma


Hi @gerstnc

I would trust the license report for this. The metrics.log includes other things like _internal indexes which are not charged. It also shows the metrics.log reports from universal forwarders. So be sure to limit your query to just host = <indexers>*

Hope this helps

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!