Deployment Setup: License Master Server -1 ******************** Splunk Indexer - 2 Splunk Search head - 1 Heavy Forwarder - 2 I have pointed all the instance to my license master server. currently , I do calculate the daily license usage of splunk by Indexers , by running the below query in License Master Server : index=_internal source=*license_usage.log* type=Usage earliest=@d |bucket _time span=1d |stats sum(b) AS volume_bytes by _time host pool i |eval volume_GB=round(volume_bytes/1024/1024/1024,3) |rename i AS indexer_GUID |JOIN indexer_GUID [|REST /services/licenser/slaves | table title label|rename title AS indexer_GUID| rename label AS indexer_name]|timechart values(volume_GB) by indexer_name usenull=f useother=f Search head & Heavy forwarder doesn't consumes license quota - But license_usage.log files still logs some bytes. (why ?) _internal logs doesnt consumes any license quota. query 1: I would need to monitor the license usage by hosts. where should I run the query ? Every splunk instance has the license_usage.log file, does all the files captures the usage ? Do I need to run the below query in each indexers and the total sum ? What is the right way ? License usage by host : index="_internal" source="*metrics.log" group="per_host_thruput" | chart sum(kb) by series | sort - sum(kb) ... View more

When i set the frozenTimePeriodInSecs value to 1 month, (for eg.) indexed data will start to delete from the start of the next month. In that case, does indexed data roll from hot to warm, then warm to cold, then cold to frozen? By default, the maximum size of hot bucket is 750 mb / 90 days before it rolls from Hot to Warm. Also, the number of Warm databases is 300/ 90 days by default. The older db will start to roll from WARM to Cold database. By default after 6 years, splunk deletes the data (i.e. frozen) If this is the case, when my retention period is short, will the data directly be deleted from hot/warm ? Please advise. ... View more

1. Controlling the size of a hot bucket : maxDataSize = auto | auto_high_volume auto = 750 mb auto_high_volume = 10 Gb maxHotSpanSecs = <positive integer> default value = 90 days If i set both the parameters, which takes the first precedence ? Does changing maxDataSize paramter's value to higher one , requires tuning of other parameters also , accordingly? 2. Performance of Search query when i make the maxDataSize = auto_high_volume i.e 10Gb where a hot bucket will grow to a size of 10Gb , till that period it retains in hot bucket ., Will the search be faster , since the data available in HOT bucket ? ... View more