Installation

Does anyone know a search that returns the "Effective daily volume" of current licensed data?

jimcroft
Explorer

Does anyone know a Splunk search that returns the current licensed volume of data?

Specifically, I mean the 'Effective daily volume' as shown by /en-GB/manager/system/licensing

Thanks

Jim

Labels (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi jimcroft

you could use something like this:

index=_internal metrics kb series!=_* group="per_index_thruput" earliest=-1@d | eval indexed_GB = (kb / 1024 / 1024)  | timechart eval(round((sum(indexed_GB)),2)) as TotalGB  fixedrange=t span=1d

which would give you todays amount of data being indexed in GB so far. Or use the deployment monitor App or the S.O.S. App or the Licence usage App.

to get the license quota use:

 | REST /services/licenser/licenses/

the field quota is what you are looking for.

cheers,
MuS

View solution in original post

u07t04
Engager

This was very help to me. i am also looking to learn/get help on setting up Pool Usgae, and possible Alerting warning leading to warning up to a violation and searching stopping onthe 5th occurrence n 30 days. Any feedback is appreciated. Regards, u07t04.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi jimcroft

you could use something like this:

index=_internal metrics kb series!=_* group="per_index_thruput" earliest=-1@d | eval indexed_GB = (kb / 1024 / 1024)  | timechart eval(round((sum(indexed_GB)),2)) as TotalGB  fixedrange=t span=1d

which would give you todays amount of data being indexed in GB so far. Or use the deployment monitor App or the S.O.S. App or the Licence usage App.

to get the license quota use:

 | REST /services/licenser/licenses/

the field quota is what you are looking for.

cheers,
MuS

MuS
SplunkTrust
SplunkTrust

yet another way to query it would be to use a remote REST query like this:

$SPLUNK_HOME/bin/splunk search '| REST /services/licenser/licenses/' -uri 'https://yourSplunkLicenseServer:8089/'
0 Karma

phoenixdigital
Builder

While this search works on the licencing server it does not appear to work from a search head.

| REST /services/licenser/licenses/

Is it possible to get the total amount you can index from a remote search head?

0 Karma

jimcroft
Explorer

Awesome, thanks MuS!

Never knew "| REST" existed... might come in very handy!

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi Jim, see my update 😉

0 Karma

jimcroft
Explorer

Thanks MuS but I'm not after the amount I've indexed, I've got that data. What I'd like to be able to fetch via a query is the total amount I can index, ie. how big is my license (the 'Effective daily volume').

Cheers

Jim

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...