Installation

Splunk license usage for Search head

Explorer

I have a 50GB splunk license running on a single Splunk Search/indexer server (host=splunkprod), my total usage peaks about 41GB per day, I noticed that the Splunk host (splunkprod) uses about 4GB in 24hr period of my total 41GB used. Why is this so high. When I run a query on the events there are only 2 data sources and 28,530 events in that 24hr period.

As I understand it Splunk licesense only counts against data flowing into splunk over a 24hr period, are there other factors that contribute to this 4GB usage?

Tags (2)
0 Karma
Highlighted

Re: Splunk license usage for Search head

Super Champion

How are you getting the 4GB number?

0 Karma
Highlighted

Re: Splunk license usage for Search head

Explorer

I am using this query to find measure which hosts are sending the most throughput that counts against our splunk license. It show 1.596GB using a search time of yesterday

host=* index=internal group="perhost_thruput" | eval mb=kb/1024| stats sum(mb) by series | where ('sum(mb)'>300) |sort by sum

0 Karma
Highlighted

Re: Splunk license usage for Search head

Super Champion

Your search is counting volume from the Splunk logs, which don't count against your license.

Try this search:

index=_internal source=*license_usage.log type=Usage 
| stats sum(b) as bytes by h 
| eval MB = round(bytes/1024/1024,1)
| fields h MB

View solution in original post

Highlighted

Re: Splunk license usage for Search head

Explorer

My query comes up with 1.596 GB and your query came up to 29MB, we are wondering if the lic usage.log does not track local host monitoring?

0 Karma