Incorrect License Usage being returned

[rmcdougal]

I am attempting to setup an alert to warn me of license usage but I am receiving bogus information back. This is search that I am running.

index=_internal source=license_usage pool="auto_generated_pool_enterprise" | eval GB=b/1024/1024/1024 | stats sum(GB) by pool

For example, this returns back 18.63GB this morning when in actuality by looking at the licensing page I have only used 4.7GB.

I assume that this has something to do with my setup which is 2 SearchHeads with one of the searchheads serving as a license master and 2 indexers.

Any ideas?

[tiny3001 · Accepted solution]

I know this is an old question, but I ran into this exact same problem recently, and this is how I solved it:

index=_internal source="*license_usage.log" pool="auto_generated_pool_enterprise" type="Usage" | eval GB=b/1024/1024/1024 | stats sum(GB) by pool

By limiting it to type="Usage", you are excluding events like "RolloverSummary", which includes the total for a specific day calculated at midnight every night.

That should bring back the accurate license usage for a given time period.

[tiny3001]

Thanks, I fixed it up to be exactly how we use it at the moment.

[sowings]

Couple of comments:

I think you may need "source=*license_usage.log".

If you move the eval after the sum, the eval will run fewer times (over fewer rows), making the search somewhat more efficient. I don't think it will matter much for this particular search, but you may find the principle useful.

[rmcdougal]

I think I figured out a solution but I am not sure why... In the license_Usage.log file there is a field labled i=6E00304....... There were three of these values, if I only search for two of the values it returns the correct number.

[sowings]

Those are the GUIDs of the indexers (which in this case could be a SH too, if it's generating data, or forwarding something other than its internal logs). They can be found by | rest /services/configs/conf-server/general and examining the guid field. Note that this assumes that all of the indexers reporting to the license master are search peers of one another. If that's not the case, you may have "unresolved" GUIDs--those for which the | rest search command can't get results.

[rmcdougal]

It only returned a value of 25 MB for three days ago.

[sdaniels]

How does this compare?

index=_internal todaysbytesindexed startdaysago=30 | eval MB_Indexed = todaysBytesIndexed/1024/1024 | stats sum(MB_Indexed) by date_mday,date_month,date_year