Splunk license calculations

[imacdonald2]

We have hit our limit and I am trying to work out the source of the overage.

For today if I run

index="_internal" source="*metrics.log" per_index_thruput | timechart
span=1d sum(kb) by series

The sum total don't make sense to me,

It gives 35.30685103 GB and splunk is reporting 17,035 MB indexed, when I look at the license information.

How do I get an accurate report that tells me what has been indexed, verse what splunk counts as indexed data.

[ChrisG]

See also http://splunk-base.splunk.com/answers/33773/send-alert-when-indexing-volume-limit-exceeded

[joshd]

Check my answer to the question above along with my blog post I linked to in the answer.. there may be a few searches there that will appeal to you to track down the issue.

[imacdonald2 · Accepted solution]

Looks like the way to calculate the numbers has changed in 4.2

The following is giving me better numbers.

index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by st useother=0