Monitoring Splunk
Highlighted

Why do we see a discrepancy between the daily licensing page and the Usage report for the past 30 days?

Ultra Champion

The daily licensing page shows that we are within the 2 TB license. However, the Usage report from the Licensing page for the past 30 days shows that we consistently pass the 5 TB mark. What can it be?

Actually with no split, it's good and with a split by Source type it's off -

alt text

alt text

Tags (1)
0 Karma
Highlighted

Re: Why do we see a discrepancy between the daily licensing page and the Usage report for the past 30 days?

Contributor

Hi!

Can you check if a "total" of all the splitted values is also getting added at the end of the usage report from the licensing page for the past 30 days?

0 Karma
Highlighted

Re: Why do we see a discrepancy between the daily licensing page and the Usage report for the past 30 days?

Ultra Champion

Not sure I understand your question ; -)

0 Karma
Highlighted

Re: Why do we see a discrepancy between the daily licensing page and the Usage report for the past 30 days?

Contributor

Can you share the search of this panel and the statistical output of the search?

0 Karma
Highlighted

Re: Why do we see a discrepancy between the daily licensing page and the Usage report for the past 30 days?

SplunkTrust
SplunkTrust

Which version of splunk are you running ?

0 Karma