Splunk license usage for Search head

[rdelmark]

I have a 50GB splunk license running on a single Splunk Search/indexer server (host=splunkprod), my total usage peaks about 41GB per day, I noticed that the Splunk host (splunkprod) uses about 4GB in 24hr period of my total 41GB used. Why is this so high. When I run a query on the events there are only 2 data sources and 28,530 events in that 24hr period.

As I understand it Splunk licesense only counts against data flowing into splunk over a 24hr period, are there other factors that contribute to this 4GB usage?

[rdelmark]

My query comes up with 1.596 GB and your query came up to 29MB, we are wondering if the lic usage.log does not track local host monitoring?

[lukejadamec · Accepted solution]

Your search is counting volume from the Splunk logs, which don't count against your license.

Try this search:

index=_internal source=*license_usage.log type=Usage 
| stats sum(b) as bytes by h 
| eval MB = round(bytes/1024/1024,1)
| fields h MB

[rdelmark]

I am using this query to find measure which hosts are sending the most throughput that counts against our splunk license. It show 1.596GB using a search time of yesterday

host=* index=_internal group="per_host_thruput" | eval mb=kb/1024| stats sum(mb) by series | where ('sum(mb)'>300) |sort by sum

[lukejadamec]

How are you getting the 4GB number?