All Apps and Add-ons

How to generate a search to determine why our license usage doubled?

Path Finder

Over the holiday weekend our license usage doubled and I need to figure out what is causing this. I have S.o.S - Splunk on Splunk installed but I am not sure if this is where I find this information. anyone have any searches to determine what devices started sending data or volume change?

0 Karma
1 Solution

Esteemed Legend

Try running these searches for the last 10 days:

| tstats count GroupBy index _time span=1d 
| timechart span=1d sum(count) BY index

Get more granular with this:

| tstats count GroupBy sourcetype index _time span=1d 
| eval entity = sourcetype . "/" . index 
| timechart span=1d sum(count) BY entity

Get the most granularity with this:

| tstats count GroupBy host sourcetype index _time span=1d 
| eval entity = host . "/" . sourcetype . "/" . index 
| timechart span=1d sum(count) BY entity

These will chart changes in # of events, but if the problem is that this metric is more or less the same and the problem is that the average size of a particular event has increased, then it will not be evident.

View solution in original post

0 Karma

Esteemed Legend

Try running these searches for the last 10 days:

| tstats count GroupBy index _time span=1d 
| timechart span=1d sum(count) BY index

Get more granular with this:

| tstats count GroupBy sourcetype index _time span=1d 
| eval entity = sourcetype . "/" . index 
| timechart span=1d sum(count) BY entity

Get the most granularity with this:

| tstats count GroupBy host sourcetype index _time span=1d 
| eval entity = host . "/" . sourcetype . "/" . index 
| timechart span=1d sum(count) BY entity

These will chart changes in # of events, but if the problem is that this metric is more or less the same and the problem is that the average size of a particular event has increased, then it will not be evident.

View solution in original post

0 Karma

Path Finder

Thank you! this helped determine what index doubled in size. How do i run these searches for that particular index? I tried adding index=XXX but the search did not like it at all

0 Karma

Esteemed Legend

Also, check out the Meta Woot! app:

https://splunkbase.splunk.com/app/2949/

0 Karma

Path Finder

Oh this looks like a great app!!! do i have to install it in all HF and indexers? I installed in the search head and no data came up.

0 Karma

Esteemed Legend

After the tstats line add this line:

| search index="XXX"
0 Karma

Path Finder

NICE! that worked!!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!