Monitoring Splunk

Daily license usage by index on Splunk Cloud

Path Finder

We just migrated over to Splunk Cloud and I'm trying to figure out how to view our daily license usage by index. I was able to do this before on the on-prem setup by going to licensing then license usage then change around the search.

With Splunk Cloud I can look up the usage in monitoring console but that shows it as a whole and when I open up the search, the index fields aren't being captured in the events.

Does anyone know how I can pull this info up?


0 Karma


Here is a base search for Splunk licensing events:

index=_internal source=*license_usage.log type="Usage"    | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)   | eval sourcetypename = st   | bin _time span=1d    | stats values(poolsz) as poolsz sum(b) as b by _time, pool, indexname, sourcetypename | eval GB=(b/1024/1024/1024)  | eval pool=(poolsz/1024/1024/1024) | fields _time, indexname, sourcetypename, GB, pool

This search will get you a list of usage across index and sourcetype for your specified timerange and is collected into 1 day buckets (since licensing goes by day). In order to get usage by index you can just add "| stats sum(GB) by indexname, _time" to the end of the search and that should give you each index's license usage for each day within your specified timerange. Unfortunately, I am not familiar with Splunk Cloud _internal events. Are these the events that aren't showing index fields within the event? If this search does not work for you, could you post a sample of the events you are seeing?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...