As, I remember reading thru the docs after 7.3 licensing for metrics is capped at 100 bytes per event which in turn seems to be a game changer. But we don't have a short ETA to get to 7.3 or later versions which makes me think about conversion of standard event format to multikv.
... View more
Hoping that my comments would be helpful if someone whats to reduce the Licensing cost on perfmon data:
I have experimented on migrating the Perfmon logs to metrics/multikv from a standard event format. Where both of the new formats has shown better results over the generic event formats in diff areas i.e., Licensing cost/storage reduction/ Search Performance.
Metrics: Better performing during the search time and cost wise it's more expensive than a regular event format because of the standard measuring of each metric log as 150 bytes when indexed. Metrics format in return resulted in consuming higher Licensing when compared to Event data.
MultiKv: mode=multikv is more efficient and granular when compared to regular event data with around 60% less license consumption when compared to other to formats with all the counter in a single logs to work efficiently.
After playing with all the 3 formats i've decided to move forward with multikv but I'm having hard time understanding the historic data migration of generic data format to multikv?
Did someone played around converting the historic perfmon event data into multikv?
... View more