License usage monitoring issue

[wmosher]

I am using the following query and getting data indexed totals much higher than expected. On our previous version/implementation of Splunk we encountered an occasional license violation but nothing like these numbers yet we have even less inputs turned on at this point. These are nearly three times larger than our license yet we have no violations so something has to be out of whack.

index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by pool

Does this query look okay? Am I using this data wrong? Does this log list pre-compressed totals or does it log cumulative totals?

[kobi_biton]

hi I am running the above query and gets a result how do I setup an alert based on the returned sum(totalGB) Field ?

Thanks

[wmosher]

This is pretty much an entirely new question, however if you save your search and check the box to schedule it, some alerting options will present themselves.

[joshd · Accepted solution]

I've listed some queries you can use on my blog...

http://www.joshd.ca/content/splunk-usage-statistic-searches

However I would highly recommend using the free Splunk Deployment Monitor app. Check it out on Splunkbase here:

http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor

[joshd]

Great to hear! That's why I wanted to post all the searches so they can independantly be used as alerts... Glad to hear it'll meet your needs! Remember to accept the answer posted so no questions are left in limbo as unanswered 🙂

[wmosher]

The numbers from this query in your post look more accurate.

index=_internal source=*metrics.log group=per_index_thruput series!=_*
| eval totalGB = (kb/1024)/1024 | timechart span=1d sum(totalGB)

The one I was trying to use must have worked at some point though, I got it from here: http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume

We are using the Deployment Monitor app as well and love it, just wanted some additional total GB alerts at mid-day.

Thanks so much!