I have a 50GB splunk license running on a single Splunk Search/indexer server (host=splunkprod), my total usage peaks about 41GB per day, I noticed that the Splunk host (splunkprod) uses about 4GB in 24hr period of my total 41GB used. Why is this so high. When I run a query on the events there are only 2 data sources and 28,530 events in that 24hr period.
As I understand it Splunk licesense only counts against data flowing into splunk over a 24hr period, are there other factors that contribute to this 4GB usage?
I am using this query to find measure which hosts are sending the most throughput that counts against our splunk license. It show 1.596GB using a search time of yesterday
host=* index=internal group="perhost_thruput" | eval mb=kb/1024| stats sum(mb) by series | where ('sum(mb)'>300) |sort by sum
Your search is counting volume from the Splunk logs, which don't count against your license.
Try this search:
index=_internal source=*license_usage.log type=Usage | stats sum(b) as bytes by h | eval MB = round(bytes/1024/1024,1) | fields h MB
My query comes up with 1.596 GB and your query came up to 29MB, we are wondering if the lic usage.log does not track local host monitoring?