How to check the total consumption out of the 500MB provided by free splunk?

[hishamjan]

Hi,

In my production environment, I have two Asterisk Servers installed where one of them caters to 95% of the data while the other caters only 5%.

I successfully installed Splunk Universal Forwarders on my two Asterisks and was able to index data from the 5% server. Now, I want to index similar data from the 95% server as well but, I'm not sure how much quota has been consumed so far out of the 500MB and indexing the 95% server might exceed the limit.

Is there a way to figure out how much out of the 500MB is used and how much Is left?

Any help will be appreciated.

[aasabatini]

Hi,

you can check on the menu  settings under the voice licensing.

Or you can check the consumption by this search:

1	index=_internal source=*license_usage.log type="Usage" splunk_server=* earliest=-1w@d | eval Date=strftime(_time, "%Y/%m/%d") | eventstats sum(b) as volume by idx, Date | eval MB=round(volume/1024/1024,5)| timechart first(MB) AS volume by idx

[hishamjan]

Hi, 

Thank you for your reply. This somewhat answers my question because this query you just shared is showing me the percentage of data consumed by the Indexer itself and not by the Forwarder (95% and 5%) servers.

The Licensing also shows the data consumed today by the indexer as well only.

I'd like to see the data consumed by the forwarders, for now, can we achieve that as well? 

Thanks.

[aasabatini · Accepted solution]

Try this

index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | stats sum(GB) by h | sort -sum(GB)

[hishamjan]

These are supposed to be added right? Otherwise, it seems as if it is 500MB per h which doesn't make sense to me..

[hishamjan]

These are supposed to be added right? Otherwise, it seems as if it is 500MB per h which doesn't make sense to me..

[aasabatini]

Sorry but I don't understand your point.

you have 500Mb free license for all the forwarders, the search show you the  license consumption by forwarder,  if you sum your values you have a total of  less than 300 Mb.

[hishamjan]

Thanks a lot, I've got your point