License usage for one of the sourcetype is high

[NDabhi21]

Dear All,

I have observed License usage for one of the sourcetype is high capmpare to privious days. However events count is low capmpare privious days .

How to check this in splunk , how to validate the licence utilization.

I.e. : 

Sourcetype: Cisco: asa 

12 July'23 - Eventcount:16819087, license usage : 21GB

14 July'23 - Eventcount:15722874, license usage : 42 GB

[PickleRick]

Judging by those values something changed on your sources and they started sending not more but bigger events.

You can check it by comparing values from

index=your_index sourcetype=your_sourcetype
| stats count avg(eval(len(_raw)))

From the same period of those two days. As you have a lot of events to check, you can sample your data with either selecting proper sampling ratio in ui or adding

| noop ratio=10000

Before the stats command.

You can of course split your stats by host so you see if there is a host or group of hosts which behave differently than others.

And it's worth checking if you don't have any anomalies in terms of sudden ingestion peaks

| tstats count where index=your_index sourcetype=your_sourcetype by host _time span=10m