Deployment Monitor License Usage question

[fuster_j]

I'm search MB Receiveied in the Deployment Monitor, License Usage. Search by Indexer seems has a lot higher MB than search by License Pool. Is it because License pool's data is compressed?

[yannK · Accepted solution]

Known issue :

"Deployment Monitor" app's "By License Pool" report shows nearly double the daily usage than "By Indexer" Report. (SPL-49519)

Until the deployment-monitor app is fixed, the best way to measure the actual license volume is to use this search on the license-master (or on the search-head, if it 's a search-peer)
index=_internal source=*license_usage* type=RolloverSummary | bucket _time span=1d | stats sum(b) AS volume by _time pool

[araitz]

This is fixed in version 5.0.0/5.0.1 of the app:

http://splunk-base.splunk.com/apps/67836/splunk-deployment-monitor

[reedmohn]

This seems to apply to the numbers on the License Report as well.
It shows approximately twice the volume of S.o.S's license reports.

[araitz]

This is a known issue with the app (SPL-49519) which we are fixing for the next release which is forthcoming.

[yannK]

for the explanation of the double counting, see this guide :
http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume