All Apps and Add-ons

Query for Exact Splunk License count

ibob0304
Communicator

I have this query which I modified to get the count of indexes each, but when i total all the indexes the sum is not matching with the splunk license used under System -> license tab in browser.

index=_internal source="*license_usage.lo*" type=Usage | table _time,  h, idx, b | eval ba = b/1024000 |timechart span=1d sum(ba) by h

and another

index=_internal source=*metrics.log group=per_index_thruput  | timechart span=1d sum(eval(kb/1024)) AS "MB indexed" by series

this is a huge difference like 300mb - 400mb compared to the system license and query output. But somedays it comes almost same with little difference.

0 Karma

woodcock
Esteemed Legend

Splunk v6.2 debuted the Distributed Management Console (DMC), now simply Management Console (MC) which can be configured on a Search Head. It almost completely replaces the Splunk-on-Splunk (S.O.S) and Splunk Deployment Monitor apps for most cases. The Licensing stats are gathered via a REAST API using the rest command | rest splunk_server=youSplunkLicenseMaster.local /services/licenser/pools but this is only available to admins. Read more about it here:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Admin/ConfiguretheMonitoringConsole.

SPECIAL NOTE: if you add your License Master as a search peer to your MC, then the License views will work, otherwise not.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...