Monitoring Splunk

Get License Usage Through Custom Script

mullinsben
New Member

I'm trying to pull the license usage with a script on my Splunk server and send a notification to Teams (along with a bunch of other information about my server along with it). I did some research, and found the license_usage.log files. There were 6 files. I was guessing b=integer was the number of bytes used, so I threw together a python script to add up all of those bytes listed in all 6 files, and got 68GB. My actual usage was 52 GB. my license_usage.log.3 had 54GB in it, but that was as close as I could come to the actual 52GB. I'm assuming I'm not looking in the correct place, or I'm adding up multiple days. I've combed Splunk documentation for what these files are, but all I'm finding is a bunch of the same Splunk query that says something about accessing this file and taking the sum of b to get the license usage.

Does anyone know how I can just pull the license usage from yesterday without running a query in Splunk? I know I can just run the query remotely with a script and use the output, but I would like to do it this way instead if it's possible.

Labels (1)
0 Karma

FrankVl
Ultra Champion

If you're just interested in yesterday's license usage and prefer to get it from the files, rather than by querying splunk. Look at the lines in those files that contain type=RolloverSummary. Those lines occur right after midnight and contain the bytes (b) ingested in the past day. If it is a single instance with a single license stack, there should be 1 event per day like that.

And that may also explain why you were getting weird results, as the license_usage.log contains (at least) 3 different types of events:
- Usage: every minute one event per index/source/sourcetype/host combo with bytes (b) ingested in past minute
- RolloverSummary: daily summary as described above
- SlaveWarnSummary: something else, not containing license usage info
So if you sum the b field, without taking into account those different types of logs, you will be summing 'live' usage logs together with the daily summary.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...