Installation

Splunk license usage for Search head

rdelmark
Explorer

I have a 50GB splunk license running on a single Splunk Search/indexer server (host=splunkprod), my total usage peaks about 41GB per day, I noticed that the Splunk host (splunkprod) uses about 4GB in 24hr period of my total 41GB used. Why is this so high. When I run a query on the events there are only 2 data sources and 28,530 events in that 24hr period.

As I understand it Splunk licesense only counts against data flowing into splunk over a 24hr period, are there other factors that contribute to this 4GB usage?

Tags (2)
0 Karma
1 Solution

lukejadamec
Super Champion

Your search is counting volume from the Splunk logs, which don't count against your license.

Try this search:

index=_internal source=*license_usage.log type=Usage 
| stats sum(b) as bytes by h 
| eval MB = round(bytes/1024/1024,1)
| fields h MB

View solution in original post

rdelmark
Explorer

My query comes up with 1.596 GB and your query came up to 29MB, we are wondering if the lic usage.log does not track local host monitoring?

0 Karma

lukejadamec
Super Champion

Your search is counting volume from the Splunk logs, which don't count against your license.

Try this search:

index=_internal source=*license_usage.log type=Usage 
| stats sum(b) as bytes by h 
| eval MB = round(bytes/1024/1024,1)
| fields h MB

View solution in original post

rdelmark
Explorer

I am using this query to find measure which hosts are sending the most throughput that counts against our splunk license. It show 1.596GB using a search time of yesterday

host=* index=_internal group="per_host_thruput" | eval mb=kb/1024| stats sum(mb) by series | where ('sum(mb)'>300) |sort by sum

0 Karma

lukejadamec
Super Champion

How are you getting the 4GB number?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!