Query for Exact Splunk License count

[ibob0304]

I have this query which I modified to get the count of indexes each, but when i total all the indexes the sum is not matching with the splunk license used under System -> license tab in browser.

index=_internal source="*license_usage.lo*" type=Usage | table _time,  h, idx, b | eval ba = b/1024000 |timechart span=1d sum(ba) by h

and another

index=_internal source=*metrics.log group=per_index_thruput  | timechart span=1d sum(eval(kb/1024)) AS "MB indexed" by series

this is a huge difference like 300mb - 400mb compared to the system license and query output. But somedays it comes almost same with little difference.

[woodcock]

Splunk v6.2 debuted the Distributed Management Console (DMC), now simply Management Console (MC) which can be configured on a Search Head. It almost completely replaces the Splunk-on-Splunk (S.O.S) and Splunk Deployment Monitor apps for most cases. The Licensing stats are gathered via a REAST API using the rest command | rest splunk_server=youSplunkLicenseMaster.local /services/licenser/pools but this is only available to admins. Read more about it here:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Admin/ConfiguretheMonitoringConsole.

SPECIAL NOTE: if you add your License Master as a search peer to your MC, then the License views will work, otherwise not.