splunk license calc

[mcbradford]

I have been using the following to give me a estimate of license usage for the day:

index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" earliest=@d+30M | eval GB=b/1024/1024/1024 | search | stats sum(GB) by pool | eval used='sum(GB)' | eval GB_Used_Today=round(used, 0) | fields GB_Used_Today

This search used to match fairly closely to what the manager would report under licensing, but now the search above is always much higher?

Does anyone know what the search is that the manager->>licensing uses?

[mcbradford]

Yesterday

index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" NOT type=RolloverSummary | eval GB=b/1024/1024/1024 | search | stats sum(GB) by pool | eval used='sum(GB)' | eval GB_Used_Today=round(used, 0) | fields GB_Used_Today

186gb

index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" | eval GB=b/1024/1024/1024 | search | stats sum(GB) by pool | eval used='sum(GB)' | eval GB_Used_Today=round(used, 0) | fields GB_Used_Today

248gb

index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" type=RolloverSummary | eval GB=b/1024/1024/1024 | search | stats sum(GB) by pool | eval used='sum(GB)' | eval GB_Used_Today=round(used, 0) | fields GB_Used_Today

62gb

Today

index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" NOT type=RolloverSummary | eval GB=b/1024/1024/1024 | search | stats sum(GB) by pool | eval used='sum(GB)' | eval GB_Used_Today=round(used, 0) | fields GB_Used_Today

66gb

index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" | eval GB=b/1024/1024/1024 | search | stats sum(GB) by pool | eval used='sum(GB)' | eval GB_Used_Today=round(used, 0) | fields GB_Used_Today

156gb

index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" type=RolloverSummary | eval GB=b/1024/1024/1024 | search | stats sum(GB) by pool | eval used='sum(GB)' | eval GB_Used_Today=round(used, 0) | fields GB_Used_Today

89gb

From the license manager I am seeing 66gb

What calculation is the manager using???

[TroyJ1]

Either exclude ("NOT type=RolloverSummary") or include only ("type=RolloverSummary") the RolloverSummary type from the original search. Otherwise, IIRC, you will measure close to double the usage volume.

[TroyJ1]

OK, it looks like the correct answer is to exclude the RolloverSummary type ("NOT type=RolloverSummary").