Archive

Deployment Monitor License Usage question

Path Finder

I'm search MB Receiveied in the Deployment Monitor, License Usage. Search by Indexer seems has a lot higher MB than search by License Pool. Is it because License pool's data is compressed?

1 Solution

Splunk Employee
Splunk Employee

Known issue :

"Deployment Monitor" app's "By License Pool" report shows nearly double the daily usage than "By Indexer" Report. (SPL-49519)

Until the deployment-monitor app is fixed, the best way to measure the actual license volume is to use this search on the license-master (or on the search-head, if it 's a search-peer)
index=internal source=*licenseusage* type=RolloverSummary | bucket _time span=1d | stats sum(b) AS volume by _time pool

View solution in original post

Splunk Employee
Splunk Employee

Known issue :

"Deployment Monitor" app's "By License Pool" report shows nearly double the daily usage than "By Indexer" Report. (SPL-49519)

Until the deployment-monitor app is fixed, the best way to measure the actual license volume is to use this search on the license-master (or on the search-head, if it 's a search-peer)
index=internal source=*licenseusage* type=RolloverSummary | bucket _time span=1d | stats sum(b) AS volume by _time pool

View solution in original post

Splunk Employee
Splunk Employee

This is fixed in version 5.0.0/5.0.1 of the app:

http://splunk-base.splunk.com/apps/67836/splunk-deployment-monitor

Communicator

This seems to apply to the numbers on the License Report as well.
It shows approximately twice the volume of S.o.S's license reports.

0 Karma

Splunk Employee
Splunk Employee

This is a known issue with the app (SPL-49519) which we are fixing for the next release which is forthcoming.

Splunk Employee
Splunk Employee

for the explanation of the double counting, see this guide :
http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume

0 Karma