How is splunk license usage determined

[robertlabrie]

Hi,

I can see the usage report, but my question is: how is it determined? Is it byte for byte against my source data? (ie "Hello World" == 11 bytes)?

I'm asking because I changed the INDEXED_EXTRACTIONS setting in my props.conf from undefined to w3c and my license usage shot up through the roof. From my usual .3gb a day to 1.4. Did all these extra fields cost me extra?

Thanks,
Rob

[MuS]

Hi robertlabrie,

usually adding extra fields does not add more license usage. License usage is based on the size of the _raw data. I cannot tell you exactly how Splunk determines the raw data size, but you can do some search-fu to verify it with your data.

Roughly, you can run a search where you look at your data over a range of indexed_time values, counting up the size of the actual events. Take this run everywhere example to get the _raw data size per source

index=_internal | eval event_size=len(_raw) | timechart sum(event_size) as event_size by source

This is a slow and expensive search and it must be run across a time range that can contain all possible events that were indexed at that time -- meaning regardless of timestamp regularity. Typically this means it must be run over all time.

hope this helps ...

cheers, MuS