Getting Data In

Does the length of metadata fields and its value, host, source, and sourcetype count against license consumption?

johnhuang
Motivator

Does the length of metadata fields and its value such as time, host, source and sourcetype count against license consumption?

For example, the following HEC JSON has a length of 212 characters but the event (_raw) is only 20 characters, is license calculated against the total json length or _raw length?

 

 

 

{
   "time":1437522387,
   "host":"dataserver01.applicationmonitoring.com",
   "source":"/var/logs/application_monitoring.log",
   "sourcetype":"application_status",
   "event":{
      "message":"Seems OK"
   }
}

 

 

 

Labels (2)
0 Karma
1 Solution

mattymo
Splunk Employee
Splunk Employee

When using the HEC event format and sending to the event endpoint (not raw endpoint) only the "event" field should be rated. The metadata fields are not. 

 
- MattyMo

View solution in original post

mattymo
Splunk Employee
Splunk Employee

When using the HEC event format and sending to the event endpoint (not raw endpoint) only the "event" field should be rated. The metadata fields are not. 

 
- MattyMo

johnhuang
Motivator

Thank you @mattymo, I was able to test and confirm your answer.

The following event sent to HEC would incur license usage of 22 bytes.

 

{
   "index":"summary_is_temp",
   "host":"testing_hec_license_consumption.acme.org",
   "source":"/var/logs/application_monitoring.log",
   "sourcetype":"application_status",
   "event":{
      "message":"Seems OK"
   }
}

 

johnhuang_1-1681397948711.png

johnhuang_0-1681398429840.png

 

mattymo
Splunk Employee
Splunk Employee

kudos to you to mistrusting and verifying!!!  🙂 

- MattyMo
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @johnhuang,

it seems the also the raw log is 212 chars not 20.

Anyway, License consuption is calculated only on the volume of _raw logs indexed:

if your event has 212 chars, it causes a License consuption of 212 bytes, even if you extract from it many fields.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...