Installation
Highlighted

Does anyone know a search that returns the "Effective daily volume" of current licensed data?

Explorer

Does anyone know a Splunk search that returns the current licensed volume of data?

Specifically, I mean the 'Effective daily volume' as shown by /en-GB/manager/system/licensing

Thanks

Jim

Labels (1)
0 Karma
Highlighted

Re: Search to determine current license volume

SplunkTrust
SplunkTrust

Hi jimcroft

you could use something like this:

index=_internal metrics kb series!=_* group="per_index_thruput" earliest=-1@d | eval indexed_GB = (kb / 1024 / 1024)  | timechart eval(round((sum(indexed_GB)),2)) as TotalGB  fixedrange=t span=1d

which would give you todays amount of data being indexed in GB so far. Or use the deployment monitor App or the S.O.S. App or the Licence usage App.

to get the license quota use:

 | REST /services/licenser/licenses/

the field quota is what you are looking for.

cheers,
MuS

View solution in original post

Highlighted

Re: Search to determine current license volume

Explorer

Thanks MuS but I'm not after the amount I've indexed, I've got that data. What I'd like to be able to fetch via a query is the total amount I can index, ie. how big is my license (the 'Effective daily volume').

Cheers

Jim

0 Karma
Highlighted

Re: Search to determine current license volume

SplunkTrust
SplunkTrust

Hi Jim, see my update 😉

0 Karma
Highlighted

Re: Search to determine current license volume

Explorer

Awesome, thanks MuS!

Never knew "| REST" existed... might come in very handy!

0 Karma
Highlighted

Re: Search to determine current license volume

While this search works on the licencing server it does not appear to work from a search head.

| REST /services/licenser/licenses/

Is it possible to get the total amount you can index from a remote search head?

0 Karma
Highlighted

Re: Search to determine current license volume

SplunkTrust
SplunkTrust

yet another way to query it would be to use a remote REST query like this:

$SPLUNK_HOME/bin/splunk search '| REST /services/licenser/licenses/' -uri 'https://yourSplunkLicenseServer:8089/'
0 Karma
Highlighted

Re: Search to determine current license volume

Engager

This was very help to me. i am also looking to learn/get help on setting up Pool Usgae, and possible Alerting warning leading to warning up to a violation and searching stopping onthe 5th occurrence n 30 days. Any feedback is appreciated. Regards, u07t04.

0 Karma