Why is there a bogus ingest volume displaying in CMC?

[dionrivera]

In the Overview tab, it shows 25TB of total ingest volume. This is incorrect, we should be at ~4TB. This is important for our licensing and storage levels.

[Roy_9]

Hello @dionrivera 
Can you validate the license volume using the below search and see if there is a difference.use the below search:
index=_internal source=*license_usage.log type=”Usage” splunk_server=*
| eval Date=strftime(_time, “%Y/%m/%d”)
| streamstats sum(b) as volume
| eval MB=round(volume/1024/1024,5)
| timechart span=1w avg(MB) by idx

Are you on Splunk Cloud or Enterprise by the way?


Thanks

[dionrivera · Accepted solution]

@Roy_9  As it turns out, the upgrade to CMC changed the timeframe it looks back to 7 days instead of 1 day which explains why my numbers were multiplied. I reached out to Splunk and they are working on changing the default timeframe to 1 day. Which makes sense because this is what teams use to gauge their daily ingest rate which goes against their licensing costs.

To answer your question, I'm on cloud. Thank you for your suggestion. You are appreciated.