Installation

Why am I getting conflicting numbers for the Trial license usage?

Path Finder

Hi,

I am running a Splunk Enterprise server v.7.1.0 with the trial license (500MB/day) and was just given a violation warning that I've exceeded the daily allowance.

When I go to the License Manager screen I see that I have used 600+ MB for the day, but when I go to the Indexes page I see that the current size of the index is 130 MB total.

What am I missing here?

Labels (1)
0 Karma
1 Solution

Legend

The figure you see is how much storage the index uses. Data is compressed before it is stored, so 130MB does not mean that you only have 130MB worth of uncompressed raw data.

View solution in original post

0 Karma

Legend

The figure you see is how much storage the index uses. Data is compressed before it is stored, so 130MB does not mean that you only have 130MB worth of uncompressed raw data.

View solution in original post

0 Karma

Champion

Can you try below search to check index volume:

index=_internal source=*license_usage.log type=Usage
| fields idx, b
| rename idx as index_name
| timechart span=1d limit=20 sum(eval(round(b/1024/1024,4))) AS Total_MB by index_name
0 Karma

Path Finder

Thanks! I've tried and this shows the 600+ MB value that is in violation.
Why is it different than the value reported in the Settings -> Indexes page?

BTW I deleted the events from the index and it is still reporting the same value. Is there a process that updates the reported value?

0 Karma

Champion

Did you restart splunk after deleting events?

The current size shows the index size on disk which after splunk data compression process.

0 Karma

Path Finder

Yes,

I restarted the server but nothing changed in both values...

0 Karma