Splunk Cloud Platform

Why is there a bogus ingest volume displaying in CMC?

dionrivera
Path Finder

In the Overview tab, it shows 25TB of total ingest volume. This is incorrect, we should be at ~4TB. This is important for our licensing and storage levels.

Labels (1)
0 Karma
1 Solution

dionrivera
Path Finder

@Roy_9  As it turns out, the upgrade to CMC changed the timeframe it looks back to 7 days instead of 1 day which explains why my numbers were multiplied. I reached out to Splunk and they are working on changing the default timeframe to 1 day. Which makes sense because this is what teams use to gauge their daily ingest rate which goes against their licensing costs.

To answer your question, I'm on cloud. Thank you for your suggestion. You are appreciated.

View solution in original post

0 Karma

Roy_9
Motivator

Hello @dionrivera 
Can you validate the license volume using the below search and see if there is a difference.use the below search:
index=_internal source=*license_usage.log type=”Usage” splunk_server=*
| eval Date=strftime(_time, “%Y/%m/%d”)
| streamstats sum(b) as volume
| eval MB=round(volume/1024/1024,5)
| timechart span=1w avg(MB) by idx

Are you on Splunk Cloud or Enterprise by the way?


Thanks

0 Karma

dionrivera
Path Finder

@Roy_9  As it turns out, the upgrade to CMC changed the timeframe it looks back to 7 days instead of 1 day which explains why my numbers were multiplied. I reached out to Splunk and they are working on changing the default timeframe to 1 day. Which makes sense because this is what teams use to gauge their daily ingest rate which goes against their licensing costs.

To answer your question, I'm on cloud. Thank you for your suggestion. You are appreciated.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...