You are right. For now this will be an infrequent ask perhaps monthly or quarterly, so I will run it adhoc or schedule it to run as a report overnight. Definitely worth looking at making this more efficient. ... View more

Two good options there. So I can see we have as is often the case with Splunk, different ways to tackle this issue. Increase the squash_threshold in server.conf to something larger than our tuple count - has an unquantified memory impact. Eval a field from _raw event length with len() - due to characters not always being 1 byte won't be 100% accurate but close enough to track usage. Create a datamodel to store the field from option 2 using a calculated field. Invest time to figure out the Splunk App for Chargeback. I will go with the quick option 2 and constrain this to the indexes / hosts I need to report on. I can work through the others when I get some quiet time 😁 Thanks everyone for your responses which helped me think this through and find a practical solution. ... View more

If you or anyone else has experience of using the chargeback app please do share it. I'm sure others will find it helpful too. ... View more

We run Splunk in a project and the costs are billed to each part of the project as they are funded separately through separate changes. So when a new set of servers are built, I'd like to be able to report with reasonable accuracy that these 10 new web servers are using say 5GB of license on average per day for billing. This will also help us predict future usage when we add another 5 servers of the same type. It will be an ongoing requirement to accurately report costs and bill correctly. I've started investigating the Splunk App for Chargeback which seems useful but overly complex for this requirement. https://splunkbase.splunk.com/app/5688 ... View more