Installation

How can I stay on top of what sources are consuming my license?

the_wolverine
Champion

I keep getting bitten by license violations and its always something new that is triggering this. Is there some way for me to better monitor my license usage so that I can stay on top if it?

I've gone under Manager >> License >> and clicked on "indexing volume search view" where I would expect to get a nice overview of my indexing activity and volume but I can only get a breakdown.

1 Solution

the_wolverine
Champion

The Splunk License Usage app written by Splunk user, joshs, is a very useful app for this purpose. It can be downloaded directly from Splunkbase: http://www.splunkbase.com/apps/All/4.x/App/app:Splunk+License+Usage

If your Splunk instance has access to the Internet, you can install the app from the UI by doing the following:

1) Log into your Splunk UI as an Admin user.

2) Go to Manager >> Apps >> and click on "Browse Splunkbase for more apps.."

3) Browse to the Splunk License Usage app and download it (You will need a registered login username/password for Splunk.com - this is different from any login on your Splunk instance.)

There is no need to restart Splunk. You can start making use of the app's custom searches and dashboards immediately by browsing to the App in Splunk UI.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Is there a reason why the indexing volume view is not helpful?

The 'split by' pulldown defaults to 'index', but you can easily change it to 'source'.

At that point it should be a pretty good tool to quickly determine what sources are coming at unexpectedly high data rates.

  • Go to the view, either clicking the link on the license page in manager, or going to 'Status>Index Status>Indexing Volume"

  • change 'Index' to 'Source'

  • click on some sources to see a timechart of that source's throughput over on the right side.

  • click the bars in that timechart to see (roughly) the events that were coming in at that time, to maybe figure out why there was a big spike there...

Certainly we created that view to be useful for things like this, so Im definitely interested to hear how in this case its not useful, or how it's not what it could be.

the_wolverine
Champion

The Splunk License Usage app written by Splunk user, joshs, is a very useful app for this purpose. It can be downloaded directly from Splunkbase: http://www.splunkbase.com/apps/All/4.x/App/app:Splunk+License+Usage

If your Splunk instance has access to the Internet, you can install the app from the UI by doing the following:

1) Log into your Splunk UI as an Admin user.

2) Go to Manager >> Apps >> and click on "Browse Splunkbase for more apps.."

3) Browse to the Splunk License Usage app and download it (You will need a registered login username/password for Splunk.com - this is different from any login on your Splunk instance.)

There is no need to restart Splunk. You can start making use of the app's custom searches and dashboards immediately by browsing to the App in Splunk UI.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...