License Usage per sourcetype

[m87]

i use the below search to calculate the license usage per sourcetype :

index=_internal source="/opt/splunk/var/log/splunk/license_usage.log"

|stats sum(b) as total_bytes by st
|eval Total_GB = (((total_bytes/1024)/1024)/1024)

but the total usage (850GB) exceeds my license which is 450GB, does this mean that the other (400GB) is not indexed or the search result is wrong ??

[gcusello · Accepted solution]

Hi m87,
for license usage I suggest to use the Splunk dashboards [Settings -- Licensing -- Usage Repors -- Previous 30 days].

Anyway, you can exceed your license until 5 times in 30 days without violation.
If you exceed your license for 5 times or more, you have a violation, but indexing and searching continue as well as no violation and there are only messages of violation.

Until version 6, after 5 violation there was a block of searches but indexing continued, now, there's no blocks, only messages.

For more details, see https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/Aboutlicenseviolations

Ciao.
Giuseppe

[m87]

Thank you gcusello for the clarification.