All Apps and Add-ons

Getting throughput info from indexers without Licence server?


In short, we don't have direct access to our licensing server (it's being managed by our service provider) - but we still need to know what the volume of indexed data is each day.

We do get a report from our service provider each day with licence usage data, but we want a dashboard doing the same.

We found that running this SPL query:

index="_internal" source="*metrics.log" per_index_thruput source="/opt/splunk/var/log/splunk/metrics.log" 
| eval gb=kb/1024/1024
| timechart span=1d sum(gb) as "Total Per Day" by series useother=f 
| fields - VALUE_*

It sort of works, but the values we get are not matching the licence usage report we are getting. It's adding about 1/3rd more to the totals.

We've got indexer and search head clusters (3 in each), splunk enterprise 8.0.0.

Any advise appreciated!

0 Karma


I've tried without any conversion - and the the results are no different when I take the KB total and convert elsewhere.

The report we get from our service provider is lower on the Licence usage than our Throughput logs from each of the indexers. Is that normal?

0 Karma


Depending on where and when in the search process the conversion from kilobytes to gigabytes is done, rounding errors may be coming into play. Try perhaps not doing the conversion till after the sum. That should help minimise the error, especially if you have lots of small bits of data coming in.

0 Karma

Esteemed Legend

Hi @ griersoncrick,
did you tried with the Splunk Monitoring Console? [Settings -- Monitoring Console -- Indexing -- License Usage -- License Usage - Previous 30 Days].


0 Karma


Yes - although it requires access to the licence-master, and we don;'t have access due to the way our service provider manages the service.

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...