Why am I getting conflicting numbers for the Trial license usage?

[vanvan]

Hi,

I am running a Splunk Enterprise server v.7.1.0 with the trial license (500MB/day) and was just given a violation warning that I've exceeded the daily allowance.

When I go to the License Manager screen I see that I have used 600+ MB for the day, but when I go to the Indexes page I see that the current size of the index is 130 MB total.

What am I missing here?

[Ayn · Accepted solution]

The figure you see is how much storage the index uses. Data is compressed before it is stored, so 130MB does not mean that you only have 130MB worth of uncompressed raw data.

[p_gurav]

Can you try below search to check index volume:

index=_internal source=*license_usage.log type=Usage
| fields idx, b
| rename idx as index_name
| timechart span=1d limit=20 sum(eval(round(b/1024/1024,4))) AS Total_MB by index_name

[vanvan]

Thanks! I've tried and this shows the 600+ MB value that is in violation.
Why is it different than the value reported in the Settings -> Indexes page?

BTW I deleted the events from the index and it is still reporting the same value. Is there a process that updates the reported value?

[p_gurav]

Did you restart splunk after deleting events?

The current size shows the index size on disk which after splunk data compression process.

[vanvan]

Yes,

I restarted the server but nothing changed in both values...