All Apps and Add-ons

Getting throughput info from indexers without Licence server?


In short, we don't have direct access to our licensing server (it's being managed by our service provider) - but we still need to know what the volume of indexed data is each day.

We do get a report from our service provider each day with licence usage data, but we want a dashboard doing the same.

We found that running this SPL query:

index="_internal" source="*metrics.log" per_index_thruput source="/opt/splunk/var/log/splunk/metrics.log" 
| eval gb=kb/1024/1024
| timechart span=1d sum(gb) as "Total Per Day" by series useother=f 
| fields - VALUE_*

It sort of works, but the values we get are not matching the licence usage report we are getting. It's adding about 1/3rd more to the totals.

We've got indexer and search head clusters (3 in each), splunk enterprise 8.0.0.

Any advise appreciated!

0 Karma


I've tried without any conversion - and the the results are no different when I take the KB total and convert elsewhere.

The report we get from our service provider is lower on the Licence usage than our Throughput logs from each of the indexers. Is that normal?

0 Karma


Depending on where and when in the search process the conversion from kilobytes to gigabytes is done, rounding errors may be coming into play. Try perhaps not doing the conversion till after the sum. That should help minimise the error, especially if you have lots of small bits of data coming in.

0 Karma

Esteemed Legend

Hi @ griersoncrick,
did you tried with the Splunk Monitoring Console? [Settings -- Monitoring Console -- Indexing -- License Usage -- License Usage - Previous 30 Days].


0 Karma


Yes - although it requires access to the licence-master, and we don;'t have access due to the way our service provider manages the service.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...