Monitoring Splunk
Highlighted

License Usage per sourcetype

New Member

i use the below search to calculate the license usage per sourcetype :

index=internal source="/opt/splunk/var/log/splunk/licenseusage.log"

|stats sum(b) as totalbytes by st
|eval Total
GB = (((total_bytes/1024)/1024)/1024)

but the total usage (850GB) exceeds my license which is 450GB, does this mean that the other (400GB) is not indexed or the search result is wrong ??

Labels (1)
Tags (1)
0 Karma
Highlighted

Re: License Usage per sourcetype

Legend

Hi m87,
for license usage I suggest to use the Splunk dashboards [Settings -- Licensing -- Usage Repors -- Previous 30 days].

Anyway, you can exceed your license until 5 times in 30 days without violation.
If you exceed your license for 5 times or more, you have a violation, but indexing and searching continue as well as no violation and there are only messages of violation.

Until version 6, after 5 violation there was a block of searches but indexing continued, now, there's no blocks, only messages.

For more details, see https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/Aboutlicenseviolations

Ciao.
Giuseppe

View solution in original post

0 Karma
Highlighted

Re: License Usage per sourcetype

New Member

Thank you gcusello for the clarification.

0 Karma