Monitoring Splunk

Daily license usage by index on Splunk Cloud

Path Finder

We just migrated over to Splunk Cloud and I'm trying to figure out how to view our daily license usage by index. I was able to do this before on the on-prem setup by going to licensing then license usage then change around the search.

With Splunk Cloud I can look up the usage in monitoring console but that shows it as a whole and when I open up the search, the index fields aren't being captured in the events.

Does anyone know how I can pull this info up?


0 Karma


Here is a base search for Splunk licensing events:

index=_internal source=*license_usage.log type="Usage"    | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)   | eval sourcetypename = st   | bin _time span=1d    | stats values(poolsz) as poolsz sum(b) as b by _time, pool, indexname, sourcetypename | eval GB=(b/1024/1024/1024)  | eval pool=(poolsz/1024/1024/1024) | fields _time, indexname, sourcetypename, GB, pool

This search will get you a list of usage across index and sourcetype for your specified timerange and is collected into 1 day buckets (since licensing goes by day). In order to get usage by index you can just add "| stats sum(GB) by indexname, _time" to the end of the search and that should give you each index's license usage for each day within your specified timerange. Unfortunately, I am not familiar with Splunk Cloud _internal events. Are these the events that aren't showing index fields within the event? If this search does not work for you, could you post a sample of the events you are seeing?

0 Karma