metrics.log and license usage

[Fam_Inv]

Hi

Hopefully someone can help. We are seeing our daily license usage being eaten up by metrics.log. Im not a Splunk expert so I don't really know what I need to do here but I know that I don't want a Splunk internal log using up my expensive Enterprise license!

Can I just remove it from the Data Inputs section in Manager or will that have an adverse effect on Splunk?

Thanks

Simon

[alacercogitatus · Accepted solution]

That log doesn't use your license, unless you b0rked something and aren't indexing to _internal index. Me thinks you have a data source somewhere else that is eating your license. Use the metrics.log or the license usage log to determine what is up. Use the search below to determine what sourcetype has the highest indexing rate. To determine source, use by s instead.

index=_internal source=*usage.log type=Usage earliest=@d| timechart span=10m sum(b) as b by st

[Fam_Inv]

Ok thanks for your help. That probably explains it

I initially started looking into a way of getting Splunk to alert me when it was getting close to using up its license. I noticed that the internal splunk logs were being indexed so figured I could create a search based on that log however I couldn't find anything meaningful in the license usage logs