All Apps and Add-ons

License usage monitoring issue

wmosher
Path Finder

I am using the following query and getting data indexed totals much higher than expected. On our previous version/implementation of Splunk we encountered an occasional license violation but nothing like these numbers yet we have even less inputs turned on at this point. These are nearly three times larger than our license yet we have no violations so something has to be out of whack.

index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by pool

Does this query look okay? Am I using this data wrong? Does this log list pre-compressed totals or does it log cumulative totals?

Tags (1)
0 Karma
1 Solution

joshd
Builder

I've listed some queries you can use on my blog...

http://www.joshd.ca/content/splunk-usage-statistic-searches

However I would highly recommend using the free Splunk Deployment Monitor app. Check it out on Splunkbase here:

http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor

View solution in original post

kobi_biton
New Member

hi I am running the above query and gets a result how do I setup an alert based on the returned sum(totalGB) Field ?

Thanks

0 Karma

wmosher
Path Finder

This is pretty much an entirely new question, however if you save your search and check the box to schedule it, some alerting options will present themselves.

0 Karma

joshd
Builder

I've listed some queries you can use on my blog...

http://www.joshd.ca/content/splunk-usage-statistic-searches

However I would highly recommend using the free Splunk Deployment Monitor app. Check it out on Splunkbase here:

http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor

joshd
Builder

Great to hear! That's why I wanted to post all the searches so they can independantly be used as alerts... Glad to hear it'll meet your needs! Remember to accept the answer posted so no questions are left in limbo as unanswered 🙂

0 Karma

wmosher
Path Finder

The numbers from this query in your post look more accurate.

index=_internal source=*metrics.log group=per_index_thruput series!=_*
| eval totalGB = (kb/1024)/1024 | timechart span=1d sum(totalGB)

The one I was trying to use must have worked at some point though, I got it from here: http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume

We are using the Deployment Monitor app as well and love it, just wanted some additional total GB alerts at mid-day.

Thanks so much!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...