Monitoring Splunk

What is the best way to measure current license usage?

fhlbcsplunkbase
Explorer

While trying to root cause a huge influx of logs into my instance I noticed that querying my current license usage through the license pool differs greatly when compared to the actual License_Usage.log statistics.

The search below give mes one number

index=_internal source=/opt/splunk/var/log/splunk/license_usage.log type=Usage
| rename b AS bytes st AS source_type idx AS index 
| stats sum(bytes) AS total
| eval total=round(total/1024/1024/1024,2)

While this search gives me a number roughly twice as high as the previous measurement

| rest splunk_server= /services/licenser/pools
| search description=auto_generated_pool_enterprise
| table used_bytes 
| eval total=round(used_bytes/1024/1024/1024,2)

Does anyone know why I would be seeing the disparity when searching the exact same time frame?

0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

Splunk REST endpoints are not time picker aware therefore you may be seeing a difference because of this...

View solution in original post

gjanders
SplunkTrust
SplunkTrust

Splunk REST endpoints are not time picker aware therefore you may be seeing a difference because of this...

fhlbcsplunkbase
Explorer

That is a good point. I don't suppose you'd know what the default behavior of the REST methods are in terms of time range? The documentation is pretty parse on details there.

0 Karma

fhlbcsplunkbase
Explorer

Your answer got me on the right path gjanders. The rest call was looking over today in UTC, while the search was running on the search head in central time. Thanks!

gjanders
SplunkTrust
SplunkTrust

No problem, thanks for accepting. The REST endpoints usually don't have the concept of a time range (for many of them), therefore you have to check on the endpoint what happens...

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...