All Apps and Add-ons

Query for Exact Splunk License count


I have this query which I modified to get the count of indexes each, but when i total all the indexes the sum is not matching with the splunk license used under System -> license tab in browser.

index=_internal source="*license_usage.lo*" type=Usage | table _time,  h, idx, b | eval ba = b/1024000 |timechart span=1d sum(ba) by h

and another

index=_internal source=*metrics.log group=per_index_thruput  | timechart span=1d sum(eval(kb/1024)) AS "MB indexed" by series

this is a huge difference like 300mb - 400mb compared to the system license and query output. But somedays it comes almost same with little difference.

0 Karma

Esteemed Legend

Splunk v6.2 debuted the Distributed Management Console (DMC), now simply Management Console (MC) which can be configured on a Search Head. It almost completely replaces the Splunk-on-Splunk (S.O.S) and Splunk Deployment Monitor apps for most cases. The Licensing stats are gathered via a REAST API using the rest command | rest splunk_server=youSplunkLicenseMaster.local /services/licenser/pools but this is only available to admins. Read more about it here:

SPECIAL NOTE: if you add your License Master as a search peer to your MC, then the License views will work, otherwise not.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...