All Apps and Add-ons

How to generate a search to determine why our license usage doubled?

avalle
Path Finder

Over the holiday weekend our license usage doubled and I need to figure out what is causing this. I have S.o.S - Splunk on Splunk installed but I am not sure if this is where I find this information. anyone have any searches to determine what devices started sending data or volume change?

0 Karma
1 Solution

woodcock
Esteemed Legend

Try running these searches for the last 10 days:

| tstats count GroupBy index _time span=1d 
| timechart span=1d sum(count) BY index

Get more granular with this:

| tstats count GroupBy sourcetype index _time span=1d 
| eval entity = sourcetype . "/" . index 
| timechart span=1d sum(count) BY entity

Get the most granularity with this:

| tstats count GroupBy host sourcetype index _time span=1d 
| eval entity = host . "/" . sourcetype . "/" . index 
| timechart span=1d sum(count) BY entity

These will chart changes in # of events, but if the problem is that this metric is more or less the same and the problem is that the average size of a particular event has increased, then it will not be evident.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Try running these searches for the last 10 days:

| tstats count GroupBy index _time span=1d 
| timechart span=1d sum(count) BY index

Get more granular with this:

| tstats count GroupBy sourcetype index _time span=1d 
| eval entity = sourcetype . "/" . index 
| timechart span=1d sum(count) BY entity

Get the most granularity with this:

| tstats count GroupBy host sourcetype index _time span=1d 
| eval entity = host . "/" . sourcetype . "/" . index 
| timechart span=1d sum(count) BY entity

These will chart changes in # of events, but if the problem is that this metric is more or less the same and the problem is that the average size of a particular event has increased, then it will not be evident.

0 Karma

avalle
Path Finder

Thank you! this helped determine what index doubled in size. How do i run these searches for that particular index? I tried adding index=XXX but the search did not like it at all

0 Karma

woodcock
Esteemed Legend

Also, check out the Meta Woot! app:

https://splunkbase.splunk.com/app/2949/

0 Karma

avalle
Path Finder

Oh this looks like a great app!!! do i have to install it in all HF and indexers? I installed in the search head and no data came up.

0 Karma

woodcock
Esteemed Legend

After the tstats line add this line:

| search index="XXX"
0 Karma

avalle
Path Finder

NICE! that worked!!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...