I am revisiting splunk to see if it will meet our goals. Right now I am working on the initial index of our data gathered via WMI. A problem I am having is figuring out which license we are going to need when we are ready to buy. It seems difficult to view our indexing volume. Right now it appears that our max per day is 2.5GB but I am guessing that is just because we imported a bunch in one day. I tried running index=_internal todaysBytesIndexed LicenseManager-Audit NOT source=*web_service.log | eval Daily_Indexing_Volume_in_MBs = todaysBytesIndexed/1024/1024 | timechart avg(Daily_Indexing_Volume_in_MBs) by host but that doesnt seem to give much data back. I am only monitoring a couple servers right now and the licensing section reports a violation at around 12:02 every morning. Does anyone have any helpful searches or reports they can share with me that will give a good breakdown of daily usage? Will my usage quiet down after a month or two? ... View more