How to track storage and license consumption from multiple hosts?



We have multiple "customers" logging into our Splunk environment and we need to be able to track their license and storage consumption. There must be a way built into Splunk that can allow us to do this, we are in the process of setup, so the time is now 🙂

Labels (1)
0 Karma


You can use this query that will graph out usage vs license

index=_internal source="*license_usage.log" type=RolloverSummary | timechart span=1d sum(b) AS DailyVolume | eval DailyVolume=round(DailyVolume/1024/1024/1024,2) | eval License="5"

Change the 5 at the end to match whatever your license is in GB/Day

0 Karma


You could put each client in their own index (cust1_web, cust1_sales, etc) and then the license usage split by index would help you.
You could also put each of them in their own drive or filesystem structure (e:\cust1\splunkdb, e:\splunkdb\cust1, /cust1/splunkdb, etc.) to give you easy OS insight to their storage total consumption too. (I have a Powershell input that tracks storage usage of directories, so you can get that OS info right through Splunk, too.)

0 Karma