License Usage

[ASE]

Hello!

We keep going over our license usage. We cant seem to find what is causing us to go over. we've gone over 3 times now. Any suggestion on how to find what is causing this, please?

[ASE]

The search did not work. Looks like it is may be cause by the data index. I checked the monitoring console and did a health check. showing License warning and violations. Category showing data indexing.

[bowesmana · Accepted solution]

This will show you your ingest usage by sourcetype

index=_internal source=/opt/splunk/var/log/splunk/license_usage.log type=Usage 
| timechart limit=40 sum(b) as data by st

Look at the monitoring console, that will also give you information on your sourcetypes/index ingestion