Splunk Search

License usage

Siddharthnegi
Contributor

How to see daily licensing usage of 1 index in Splunk.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

On MC (monitoring console) is own dashboard to show license usage. There are some selection by which you can see values. Just go

Settings -> Monitoring Console 

Indexing -> License Usage -> Historic License Usage

then Split By: By Index

Otherwise if you have all in one server you could check this also from

Settings -> Licensing

Usage Report

Previous 60 days

Split by: index

 

Those both shows by N (10?) biggest indexes. If you want to check some specific index then just copy that query by opening it from magnify glass.

Then modify it something like

index=_internal idx=<YOUR INDEX NAME>
    [ `set_local_host`] source=*license_usage.log* type="Usage" 
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) 
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) 
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
| bin _time span=1d 
| stats sum(b) as b by _time, pool, s, st, h, idx 
| timechart span=1d sum(b) AS volumeB by idx fixedrange=false 
| join type=outer _time 
    [ search index=_internal idx=<YOUR INDEX NAME>
        [ `set_local_host`] source=*license_usage.log* type="RolloverSummary" earliest=-30d@d 
    | eval _time=_time - 43200 
    | bin _time span=1d 
    | dedup _time stack 
    | stats sum(stacksz) AS "stack size" by _time] 
| fields - _timediff 
| foreach * 
    [ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...