All Apps and Add-ons

License usage monitoring issue

wmosher
Path Finder

I am using the following query and getting data indexed totals much higher than expected. On our previous version/implementation of Splunk we encountered an occasional license violation but nothing like these numbers yet we have even less inputs turned on at this point. These are nearly three times larger than our license yet we have no violations so something has to be out of whack.

index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by pool

Does this query look okay? Am I using this data wrong? Does this log list pre-compressed totals or does it log cumulative totals?

Tags (1)
0 Karma
1 Solution

joshd
Builder

I've listed some queries you can use on my blog...

http://www.joshd.ca/content/splunk-usage-statistic-searches

However I would highly recommend using the free Splunk Deployment Monitor app. Check it out on Splunkbase here:

http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor

View solution in original post

kobi_biton
New Member

hi I am running the above query and gets a result how do I setup an alert based on the returned sum(totalGB) Field ?

Thanks

0 Karma

wmosher
Path Finder

This is pretty much an entirely new question, however if you save your search and check the box to schedule it, some alerting options will present themselves.

0 Karma

joshd
Builder

I've listed some queries you can use on my blog...

http://www.joshd.ca/content/splunk-usage-statistic-searches

However I would highly recommend using the free Splunk Deployment Monitor app. Check it out on Splunkbase here:

http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor

View solution in original post

joshd
Builder

Great to hear! That's why I wanted to post all the searches so they can independantly be used as alerts... Glad to hear it'll meet your needs! Remember to accept the answer posted so no questions are left in limbo as unanswered 🙂

0 Karma

wmosher
Path Finder

The numbers from this query in your post look more accurate.

index=_internal source=*metrics.log group=per_index_thruput series!=_*
| eval totalGB = (kb/1024)/1024 | timechart span=1d sum(totalGB)

The one I was trying to use must have worked at some point though, I got it from here: http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume

We are using the Deployment Monitor app as well and love it, just wanted some additional total GB alerts at mid-day.

Thanks so much!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!