metrics counting against licence usage

[neovest]

I have read that the metric log should not count against our usage license and that if it was we are somehow setup wrong. I noticed that we were butting up against our license usage and when I looked at who was using the data I saw our slunk metrics logs in the top 5. I also read that we needed to change the way those logs were being indexed. Can anyone tell me what to change in order to make sure that the metric and usage logs are not counted against my usage license?

Thanks

[hagjos43]

Run this query. It'll output what is hitting your license.

index=_internal source=*license_usage.log type="Usage" splunk_server=* earliest=-1w@d | eval Date=strftime(_time, "%Y/%m/%d") | eventstats sum(b) as volume by idx, Date | eval MB=round(volume/1024/1024,5)| timechart first(MB) AS volume by idx 

[neovest]

Thanks for the reply, I ran the command and this is the output.

_time default fix_data msexchange nagios os perfmon
2016-08-05 2193.37085 22.57836 19.81520 31.72157 3.59491 7.38140
2016-08-06

2016-08-07

2016-08-08

2016-08-09

2016-08-10

2016-08-11 8994.77014 108.25990 9.12393 29.93557 23.23263 7.83752
2016-08-12 6982.62488 337.65538 14.80471 17.33307 8.72202

Not quite sure what to make of the default

[somesoni2]

The default index is "main" index (or some other index if you've changed the configuration).