Monitoring Splunk

What is the best way to measure current license usage?

fhlbcsplunkbase
Explorer

While trying to root cause a huge influx of logs into my instance I noticed that querying my current license usage through the license pool differs greatly when compared to the actual License_Usage.log statistics.

The search below give mes one number

index=_internal source=/opt/splunk/var/log/splunk/license_usage.log type=Usage
| rename b AS bytes st AS source_type idx AS index 
| stats sum(bytes) AS total
| eval total=round(total/1024/1024/1024,2)

While this search gives me a number roughly twice as high as the previous measurement

| rest splunk_server= /services/licenser/pools
| search description=auto_generated_pool_enterprise
| table used_bytes 
| eval total=round(used_bytes/1024/1024/1024,2)

Does anyone know why I would be seeing the disparity when searching the exact same time frame?

0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

Splunk REST endpoints are not time picker aware therefore you may be seeing a difference because of this...

Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/
Version Control for Splunk https://splunkbase.splunk.com/app/4355/

View solution in original post

gjanders
SplunkTrust
SplunkTrust

Splunk REST endpoints are not time picker aware therefore you may be seeing a difference because of this...

Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/
Version Control for Splunk https://splunkbase.splunk.com/app/4355/

View solution in original post

fhlbcsplunkbase
Explorer

That is a good point. I don't suppose you'd know what the default behavior of the REST methods are in terms of time range? The documentation is pretty parse on details there.

0 Karma

fhlbcsplunkbase
Explorer

Your answer got me on the right path gjanders. The rest call was looking over today in UTC, while the search was running on the search head in central time. Thanks!

0 Karma

gjanders
SplunkTrust
SplunkTrust

No problem, thanks for accepting. The REST endpoints usually don't have the concept of a time range (for many of them), therefore you have to check on the endpoint what happens...

Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/
Version Control for Splunk https://splunkbase.splunk.com/app/4355/
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!