Splunk server index over usage

[jbthomas1975]

Is it standard for the Splunk server itself to be over 50% of the daily indexing total? In our production environment, we are starting run over the daily and simply because of the splunk server itself. I understand its what does the heavy lifting, but its hard to base how much licensing you may need when you dont know how to gauge what the server will utilize

jbthomas1975_0-1703254824534.png

[VatsalJagani]

@jbthomas1975 - Are you looking at the license usage by host??

How much is the usage by Splunk servers in GB?

[tscroggins]

Hi @jbthomas1975,

What are you collecting from your Splunk host?

Internal indexes--_audit, _internal, _introspection, _metrics, etc.--don't count against ingest-based licensing but do factor into capacity planning.