Monitoring Splunk

Splunk license calculations

imacdonald2
Path Finder

We have hit our limit and I am trying to work out the source of the overage.

For today if I run

index="_internal" source="*metrics.log" per_index_thruput | timechart
span=1d sum(kb) by series

The sum total don't make sense to me,

It gives 35.30685103 GB and splunk is reporting 17,035 MB indexed, when I look at the license information.

How do I get an accurate report that tells me what has been indexed, verse what splunk counts as indexed data.

Tags (1)
0 Karma
1 Solution

imacdonald2
Path Finder

Looks like the way to calculate the numbers has changed in 4.2

The following is giving me better numbers.

index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by st useother=0

View solution in original post

0 Karma

joshd
Builder

Check my answer to the question above along with my blog post I linked to in the answer.. there may be a few searches there that will appeal to you to track down the issue.

0 Karma

imacdonald2
Path Finder

Looks like the way to calculate the numbers has changed in 4.2

The following is giving me better numbers.

index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by st useother=0

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...