Splunk Enterprise

Difference between Calculating SPLUNK License from DMC and from the SPL query

Amirahussein
Path Finder

Dears

What are the main differences between calculating SPLUNK daily license from the ready-made query located in SPLUNK master (DMC Alert - Total License Usage Near Daily Quota)

And from using below query:

index=_internal source=*license_usage.log type=Usage
| stats sum(b) as bytes by idx
| eval LicenseUsage_GB = round(bytes/1024/1024/1024,5)
|table idx LicenseUsage_GB

As I found a remarkable differences when using the 2 above ways even when calculating the total available license.

Thanks

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...