How to determine the amount of logs per server per day

[kekac00]

I have about 25 servers to add to Splunk. Currently we run about 35 gig per day with our license at 50 gig. Can it be determined on average the size of logs per server per day. I know that it will depend on how much traffic the server gets and all but I don't want to run over my license amount. Thanks for answers in advance.

[skoelpin · Accepted solution]

You can look in the license master settings or run this query

index=_internal 
    [ `set_local_host`] source=*license_usage.log* type="Usage" 
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) 
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) 
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
| bin _time span=1d 
| stats sum(b) as b by _time, pool, s, st, h, idx 
| timechart span=1d sum(b) AS volumeB by h fixedrange=false 
| join type=outer _time 
    [ search index=_internal 
        [ `set_local_host`] source=*license_usage.log* type="RolloverSummary" earliest=-30d@d 
    | eval _time=_time - 43200 
    | bin _time span=1d 
    | stats latest(stacksz) AS "stack size" by _time] 
| fields - _timediff 
| foreach * 
    [ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]

Standard licensing allows you 5 overages per month before it prevents searching. If your on a non-enforcement license you can go over as much as you want a "true up" at the end of the year