Why is the "Daily License Usage" showing incorrect values?

Path Finder


I recently migrated a Splunk instance from a Windows environment to a Linux environment. Since the migration, dashboards on the "License Usage" page have been displaying usage values up to ten times larger than are actually being indexed. There have been no license violations, so this data can't be correct. What might be causing this?

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Hi khagan,

I assume the Splunk instant you migrated is the license master, right? Because if it's a license slave, none of the migration activities matter.

On the license master, please review license_usage.log under SPLUNK_HOME/var/log/ to see what has caused the increased license usage.
You can also use the following searches in Splunk Web to investigate your license consumption issue.

index=_internal component=LicenseUsage* | top type

index=_internal component=Metrics per_index_thruput | eval mb=(kb/1024) | timechart span=1h sum(mb) by series | addtotals

Hope it helps. Thanks!

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: CFP Site: CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...