How to determine what is causing a Splunk indexer to consume more than 10% of the daily license?

[steveirogers]

My environment generates on average about 12GB of logs daily (out of a license for 20GB). The Splunk indexer is generating on average about 1.5GB to 1.8GB daily log volume? This seems excessive / high? How could I determine what is causing the indexer to generate this high volume of logs? Or is this "normal"?

Thanks.

[steveirogers]

Hello Kristian,
Thanks for the response. In digging into this further, it appears the bulk of the logs entries from indexer are coming from "/opt/splunk/var/log/splunk/metrics.log". I will check into this further.

[kristian_kolb]

These logs (metrics, splunkd etc) go into the _internal index, and are not counted towards your license.
/k

[kristian_kolb]

Well, there can be quite a few events in the _internal index, but they are only retained for 30 days by default. However, these are not counted towards your license allowance.

A separate thing could be that you have regular log files that are being indexed in your system which seem to come from your indexer. I.e. if you mount a remote share from your indexer, and read the files from there Depending on how you do your configs, these events may be labeled as coming from your indexer (and will count towards your license).