Does anyone know a search that returns the "Effective daily volume" of current licensed data?

[jimcroft]

Does anyone know a Splunk search that returns the current licensed volume of data?

Specifically, I mean the 'Effective daily volume' as shown by /en-GB/manager/system/licensing

Thanks

Jim

[u07t04]

This was very help to me. i am also looking to learn/get help on setting up Pool Usgae, and possible Alerting warning leading to warning up to a violation and searching stopping onthe 5th occurrence n 30 days. Any feedback is appreciated. Regards, u07t04.

[MuS · Accepted solution]

Hi jimcroft

you could use something like this:

index=_internal metrics kb series!=_* group="per_index_thruput" earliest=-1@d | eval indexed_GB = (kb / 1024 / 1024)  | timechart eval(round((sum(indexed_GB)),2)) as TotalGB  fixedrange=t span=1d

which would give you todays amount of data being indexed in GB so far. Or use the deployment monitor App or the S.O.S. App or the Licence usage App.

to get the license quota use:

 | REST /services/licenser/licenses/

the field quota is what you are looking for.

cheers,
MuS

[MuS]

yet another way to query it would be to use a remote REST query like this:

$SPLUNK_HOME/bin/splunk search '| REST /services/licenser/licenses/' -uri 'https://yourSplunkLicenseServer:8089/'

[phoenixdigital]

While this search works on the licencing server it does not appear to work from a search head.

| REST /services/licenser/licenses/

Is it possible to get the total amount you can index from a remote search head?

[jimcroft]

Awesome, thanks MuS!

Never knew "| REST" existed... might come in very handy!

[MuS]

Hi Jim, see my update 😉

[jimcroft]

Thanks MuS but I'm not after the amount I've indexed, I've got that data. What I'd like to be able to fetch via a query is the total amount I can index, ie. how big is my license (the 'Effective daily volume').

Cheers

Jim