How to track storage and license consumption from multiple hosts?

[brent_weaver]

Hello.

We have multiple "customers" logging into our Splunk environment and we need to be able to track their license and storage consumption. There must be a way built into Splunk that can allow us to do this, we are in the process of setup, so the time is now 🙂

[dbcase]

You can use this query that will graph out usage vs license

index=_internal source="*license_usage.log" type=RolloverSummary | timechart span=1d sum(b) AS DailyVolume | eval DailyVolume=round(DailyVolume/1024/1024/1024,2) | eval License="5"

Change the 5 at the end to match whatever your license is in GB/Day

[lycollicott]

You could put each client in their own index (cust1_web, cust1_sales, etc) and then the license usage split by index would help you.
You could also put each of them in their own drive or filesystem structure (e:\cust1\splunkdb, e:\splunkdb\cust1, /cust1/splunkdb, etc.) to give you easy OS insight to their storage total consumption too. (I have a Powershell input that tracks storage usage of directories, so you can get that OS info right through Splunk, too.)