Irritating error in calculating the license usage....

[wwhitener]

I am looking at the app on our test box. When I am on the sandbox, I'm indexing very small files and this seems to be accurate compared to the Licensing - Manager page in the Splunk app proper. However, when I go to our test box, it is wrong--the value that it is showing is exactly half of what the Licensing - Manager page shows.

It's a standard setup--there's no distributed servers, no crazy setup switching servers or anything. This is on the search head only. It's for a 1 GB license--so its not like there should be 238 MB allowance for rounding.

Any ideas on anywhere else that I can check?
Cheers!

[hexx]

We recently found out an error in the license usage panel of the Metrics view of the Splunk on Splunk app, which I assume you are using here.

As of SoS 2.1.0, when running on Splunk 4.3.x. the license usage chart only shows usage for the heaviest slave consumer for the day instead total usage by pool.

This will be fixed in the next release of SoS (2.2) but if you'd like to test the fix for yourself, you can download it directly here.

Installation instructions for the fixed metrics.xml :

• Overwrite $SPLUNK_HOME/etc/apps/sos/default/data/ui/views/metrics.xml with the this file
• On the search-head where SoS is installed, hit http[s]://[splunkweb_hostname]:[splunkweb_port]/debug/refresh?entity=admin/views to reload the views
• Then hit http[s]://[splunkweb_hostname]:[splunkweb_port]/apps/sos/metrics and see if the license usage panel now reports accurate daily usage, reflecting the aggregate of the daily quota usage of all license slaves

[hexx]

My apologies, I thought that was the case since you used the Splunk on Splunk tag. I encourage you to try the Metrics view of this app to plot your license usage over time (with the fixed metrics.xml included above!). That being said, if you attach a screenshot of what you see in the Manager > Licensing page vs. an explanation of how you come up with a different, expected number, we can probably help you.

[wwhitener]

Hey,

Regrettably I am not using Splunk on Splunk.

The license page is found by going to the Manager > Licensing. There are two values--the volume indexed today and the percentage--that I'd like to ultimately be able to get out.

Thank you for your answer, though.