Getting Data In

Why does license usage differ between the number found using RolloverSummary versus Usage from the license_usage.log file?

coleman07
Path Finder

I did the two following searches using the same license_usage.log file and got different results for yesterday's total bytes used by that indexer. Why are they different and which is more accurate?

index=_internal host=splunk source=*license_usage.log type="RolloverSummary" slave=09F538B3-E658-4C42-A213-EE89679465E0 | eval _time=_time - 43200 | bin _time span=1d  | eval TotalBytes=b/1024/1024/1024

Result: 63.288 GB

index = _internal host = splunk source = *license_usage.log type = "Usage" i=09F538B3-E658-4C42-A213-EE89679465E0 | stats sum(b) as TotalBytes | eval TotalBytes=TotalBytes/1024/1024/1024

Result: 63.2525 GB

Same time span - different result.

0 Karma

bgronvall_splun
Splunk Employee
Splunk Employee

Usage is a blanket counter which increments whenever something is indexed. RolloverSummary is a tall(sum) of the days usage which is calculated just after midnight. There is likely a discrepancy with the time period searched leaving a gap between the summary evaluation and the time period beginning/end.

0 Karma

Olli1919
Path Finder

I am seeying the same as coleman07 describes, only that this is happening in LURV (http://docs.splunk.com/Documentation/Splunk/6.4.1/Admin/AboutSplunksLicenseUsageReportView ). When going into the "Previous 30 Days" tab and choosing no splitby, a license violation is shown, when switching to a splitby (e.g. index), there a still 50GB free before the pool size is reached. So there's a delta of 50GB between "RolloverSummary" and "Usage" calculations.

Trying to find these unaccounted, missing 50GB has been unfruitful so far.

Can you please elaborate a little more on these artificats? What volume does count towards license volume, is it "RolloverSummary"?

0 Karma

Olli1919
Path Finder

Now with the new DMC in v6.4 there are still both types of license usage reporting. And it is Type=RolloverSummary, which is the reference for actual daily license count. Unfortunately Type=RolloverSummary does not offer the sourcetype. Only Type=Usage does. Yesterday we had delta of 120GB between both license usages calculation types. It is thus nearly impossible do analyze a license violation down to the sourcetype / data source which caused it, when missing 120GB in the reporting.
One could think that splunk has no interest in offering a license usage report, which would allow customers to identify what data sources they spend their money on.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...