We have hit our limit and I am trying to work out the source of the overage.
For today if I run
index="_internal" source="*metrics.log" per_index_thruput | timechart
span=1d sum(kb) by series
The sum total don't make sense to me,
It gives 35.30685103 GB and splunk is reporting 17,035 MB indexed, when I look at the license information.
How do I get an accurate report that tells me what has been indexed, verse what splunk counts as indexed data.
Looks like the way to calculate the numbers has changed in 4.2
The following is giving me better numbers.
index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by st useother=0
View solution in original post
See also http://splunk-base.splunk.com/answers/33773/send-alert-when-indexing-volume-limit-exceeded
Check my answer to the question above along with my blog post I linked to in the answer.. there may be a few searches there that will appeal to you to track down the issue.