Getting Data In

Does the length of metadata fields and its value, host, source, and sourcetype count against license consumption?

johnhuang
Motivator

Does the length of metadata fields and its value such as time, host, source and sourcetype count against license consumption?

For example, the following HEC JSON has a length of 212 characters but the event (_raw) is only 20 characters, is license calculated against the total json length or _raw length?

 

 

 

{
   "time":1437522387,
   "host":"dataserver01.applicationmonitoring.com",
   "source":"/var/logs/application_monitoring.log",
   "sourcetype":"application_status",
   "event":{
      "message":"Seems OK"
   }
}

 

 

 

Labels (2)
0 Karma
1 Solution

mattymo
Splunk Employee
Splunk Employee

When using the HEC event format and sending to the event endpoint (not raw endpoint) only the "event" field should be rated. The metadata fields are not. 

 
- MattyMo

View solution in original post

mattymo
Splunk Employee
Splunk Employee

When using the HEC event format and sending to the event endpoint (not raw endpoint) only the "event" field should be rated. The metadata fields are not. 

 
- MattyMo

johnhuang
Motivator

Thank you @mattymo, I was able to test and confirm your answer.

The following event sent to HEC would incur license usage of 22 bytes.

 

{
   "index":"summary_is_temp",
   "host":"testing_hec_license_consumption.acme.org",
   "source":"/var/logs/application_monitoring.log",
   "sourcetype":"application_status",
   "event":{
      "message":"Seems OK"
   }
}

 

johnhuang_1-1681397948711.png

johnhuang_0-1681398429840.png

 

mattymo
Splunk Employee
Splunk Employee

kudos to you to mistrusting and verifying!!!  🙂 

- MattyMo
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @johnhuang,

it seems the also the raw log is 212 chars not 20.

Anyway, License consuption is calculated only on the volume of _raw logs indexed:

if your event has 212 chars, it causes a License consuption of 212 bytes, even if you extract from it many fields.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...