I have this query which I modified to get the count of indexes each, but when i total all the indexes the sum is not matching with the splunk license used under System -> license tab in browser.
index=_internal source="*license_usage.lo*" type=Usage | table _time, h, idx, b | eval ba = b/1024000 |timechart span=1d sum(ba) by h
and another
index=_internal source=*metrics.log group=per_index_thruput | timechart span=1d sum(eval(kb/1024)) AS "MB indexed" by series
this is a huge difference like 300mb - 400mb compared to the system license and query output. But somedays it comes almost same with little difference.
Splunk v6.2 debuted the Distributed Management Console
(DMC), now simply Management Console
(MC) which can be configured on a Search Head. It almost completely replaces the Splunk-on-Splunk
(S.O.S) and Splunk Deployment Monitor
apps for most cases. The Licensing stats are gathered via a REAST API using the rest command | rest splunk_server=youSplunkLicenseMaster.local /services/licenser/pools
but this is only available to admins. Read more about it here:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Admin/ConfiguretheMonitoringConsole.
SPECIAL NOTE: if you add your License Master as a search peer to your MC, then the License views will work, otherwise not.