Monitoring Splunk

Splunk license calculations

imacdonald2
Path Finder

We have hit our limit and I am trying to work out the source of the overage.

For today if I run

index="_internal" source="*metrics.log" per_index_thruput | timechart
span=1d sum(kb) by series

The sum total don't make sense to me,

It gives 35.30685103 GB and splunk is reporting 17,035 MB indexed, when I look at the license information.

How do I get an accurate report that tells me what has been indexed, verse what splunk counts as indexed data.

Tags (1)
0 Karma
1 Solution

imacdonald2
Path Finder

Looks like the way to calculate the numbers has changed in 4.2

The following is giving me better numbers.

index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by st useother=0

View solution in original post

0 Karma

ChrisG
Splunk Employee
Splunk Employee

joshd
SplunkTrust
SplunkTrust

Check my answer to the question above along with my blog post I linked to in the answer.. there may be a few searches there that will appeal to you to track down the issue.

0 Karma

imacdonald2
Path Finder

Looks like the way to calculate the numbers has changed in 4.2

The following is giving me better numbers.

index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by st useother=0

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!