Installation

Why am I getting conflicting numbers for the Trial license usage?

vanvan
Path Finder

Hi,

I am running a Splunk Enterprise server v.7.1.0 with the trial license (500MB/day) and was just given a violation warning that I've exceeded the daily allowance.

When I go to the License Manager screen I see that I have used 600+ MB for the day, but when I go to the Indexes page I see that the current size of the index is 130 MB total.

What am I missing here?

Labels (1)
0 Karma
1 Solution

Ayn
Legend

The figure you see is how much storage the index uses. Data is compressed before it is stored, so 130MB does not mean that you only have 130MB worth of uncompressed raw data.

View solution in original post

0 Karma

Ayn
Legend

The figure you see is how much storage the index uses. Data is compressed before it is stored, so 130MB does not mean that you only have 130MB worth of uncompressed raw data.

0 Karma

p_gurav
Champion

Can you try below search to check index volume:

index=_internal source=*license_usage.log type=Usage
| fields idx, b
| rename idx as index_name
| timechart span=1d limit=20 sum(eval(round(b/1024/1024,4))) AS Total_MB by index_name
0 Karma

vanvan
Path Finder

Thanks! I've tried and this shows the 600+ MB value that is in violation.
Why is it different than the value reported in the Settings -> Indexes page?

BTW I deleted the events from the index and it is still reporting the same value. Is there a process that updates the reported value?

0 Karma

p_gurav
Champion

Did you restart splunk after deleting events?

The current size shows the index size on disk which after splunk data compression process.

0 Karma

vanvan
Path Finder

Yes,

I restarted the server but nothing changed in both values...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...