Installation

Does anyone know a search that returns the "Effective daily volume" of current licensed data?

jimcroft
Explorer

Does anyone know a Splunk search that returns the current licensed volume of data?

Specifically, I mean the 'Effective daily volume' as shown by /en-GB/manager/system/licensing

Thanks

Jim

Labels (1)
0 Karma
1 Solution

MuS
Legend

Hi jimcroft

you could use something like this:

index=_internal metrics kb series!=_* group="per_index_thruput" earliest=-1@d | eval indexed_GB = (kb / 1024 / 1024)  | timechart eval(round((sum(indexed_GB)),2)) as TotalGB  fixedrange=t span=1d

which would give you todays amount of data being indexed in GB so far. Or use the deployment monitor App or the S.O.S. App or the Licence usage App.

to get the license quota use:

 | REST /services/licenser/licenses/

the field quota is what you are looking for.

cheers,
MuS

View solution in original post

u07t04
Engager

This was very help to me. i am also looking to learn/get help on setting up Pool Usgae, and possible Alerting warning leading to warning up to a violation and searching stopping onthe 5th occurrence n 30 days. Any feedback is appreciated. Regards, u07t04.

0 Karma

MuS
Legend

Hi jimcroft

you could use something like this:

index=_internal metrics kb series!=_* group="per_index_thruput" earliest=-1@d | eval indexed_GB = (kb / 1024 / 1024)  | timechart eval(round((sum(indexed_GB)),2)) as TotalGB  fixedrange=t span=1d

which would give you todays amount of data being indexed in GB so far. Or use the deployment monitor App or the S.O.S. App or the Licence usage App.

to get the license quota use:

 | REST /services/licenser/licenses/

the field quota is what you are looking for.

cheers,
MuS

MuS
Legend

yet another way to query it would be to use a remote REST query like this:

$SPLUNK_HOME/bin/splunk search '| REST /services/licenser/licenses/' -uri 'https://yourSplunkLicenseServer:8089/'
0 Karma

phoenixdigital
Builder

While this search works on the licencing server it does not appear to work from a search head.

| REST /services/licenser/licenses/

Is it possible to get the total amount you can index from a remote search head?

0 Karma

jimcroft
Explorer

Awesome, thanks MuS!

Never knew "| REST" existed... might come in very handy!

0 Karma

MuS
Legend

Hi Jim, see my update 😉

0 Karma

jimcroft
Explorer

Thanks MuS but I'm not after the amount I've indexed, I've got that data. What I'd like to be able to fetch via a query is the total amount I can index, ie. how big is my license (the 'Effective daily volume').

Cheers

Jim

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...