Security

Deployment Monitor License Usage question

fuster_j
Path Finder

I'm search MB Receiveied in the Deployment Monitor, License Usage. Search by Indexer seems has a lot higher MB than search by License Pool. Is it because License pool's data is compressed?

1 Solution

yannK
Splunk Employee
Splunk Employee

Known issue :

"Deployment Monitor" app's "By License Pool" report shows nearly double the daily usage than "By Indexer" Report. (SPL-49519)

Until the deployment-monitor app is fixed, the best way to measure the actual license volume is to use this search on the license-master (or on the search-head, if it 's a search-peer)
index=_internal source=*license_usage* type=RolloverSummary | bucket _time span=1d | stats sum(b) AS volume by _time pool

View solution in original post

yannK
Splunk Employee
Splunk Employee

Known issue :

"Deployment Monitor" app's "By License Pool" report shows nearly double the daily usage than "By Indexer" Report. (SPL-49519)

Until the deployment-monitor app is fixed, the best way to measure the actual license volume is to use this search on the license-master (or on the search-head, if it 's a search-peer)
index=_internal source=*license_usage* type=RolloverSummary | bucket _time span=1d | stats sum(b) AS volume by _time pool

araitz
Splunk Employee
Splunk Employee

This is fixed in version 5.0.0/5.0.1 of the app:

http://splunk-base.splunk.com/apps/67836/splunk-deployment-monitor

reedmohn
Communicator

This seems to apply to the numbers on the License Report as well.
It shows approximately twice the volume of S.o.S's license reports.

0 Karma

araitz
Splunk Employee
Splunk Employee

This is a known issue with the app (SPL-49519) which we are fixing for the next release which is forthcoming.

yannK
Splunk Employee
Splunk Employee

for the explanation of the double counting, see this guide :
http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume

0 Karma
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...