Installation

License Management: How to find Index consumption by host and source/sourcetype.

dawfun
New Member

We've been working on managing our Splunk license, but it's been a really manual effort and it seems like Splunk could/should have a way to see index metrics by host and source on a daily basis. I can't find this info anywhere, so maybe someone out there can help with a clue (or save me the trouble of looking for something that doesn't exist).

Any ideas?

Tags (1)
0 Karma

ChrisG
Splunk Employee
Splunk Employee

If you are using Splunk Enterprise 6.x, use the License Usage Report View. If you are on Splunk 5.x, download and install the Splunk on Splunk app, it has the same view available for 5.x customers.

reed_kelly
Contributor

Also look at index=_internal component=LicenseUsage. You can aggregate on s (source), st (sourcetype), h (host) and i (indexer). The field b is bytes.

This must be done from the License Manager or where ever those logs are made available.

lukejadamec
Super Champion

This post has some good searches if you want to do it from the search app.
http://answers.splunk.com/answers/140/how-do-i-determine-my-indexing-volume-by-host-source-or-source...

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...