Installation

How can I stay on top of what sources are consuming my license?

the_wolverine
Champion

I keep getting bitten by license violations and its always something new that is triggering this. Is there some way for me to better monitor my license usage so that I can stay on top if it?

I've gone under Manager >> License >> and clicked on "indexing volume search view" where I would expect to get a nice overview of my indexing activity and volume but I can only get a breakdown.

1 Solution

the_wolverine
Champion

The Splunk License Usage app written by Splunk user, joshs, is a very useful app for this purpose. It can be downloaded directly from Splunkbase: http://www.splunkbase.com/apps/All/4.x/App/app:Splunk+License+Usage

If your Splunk instance has access to the Internet, you can install the app from the UI by doing the following:

1) Log into your Splunk UI as an Admin user.

2) Go to Manager >> Apps >> and click on "Browse Splunkbase for more apps.."

3) Browse to the Splunk License Usage app and download it (You will need a registered login username/password for Splunk.com - this is different from any login on your Splunk instance.)

There is no need to restart Splunk. You can start making use of the app's custom searches and dashboards immediately by browsing to the App in Splunk UI.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Is there a reason why the indexing volume view is not helpful?

The 'split by' pulldown defaults to 'index', but you can easily change it to 'source'.

At that point it should be a pretty good tool to quickly determine what sources are coming at unexpectedly high data rates.

  • Go to the view, either clicking the link on the license page in manager, or going to 'Status>Index Status>Indexing Volume"

  • change 'Index' to 'Source'

  • click on some sources to see a timechart of that source's throughput over on the right side.

  • click the bars in that timechart to see (roughly) the events that were coming in at that time, to maybe figure out why there was a big spike there...

Certainly we created that view to be useful for things like this, so Im definitely interested to hear how in this case its not useful, or how it's not what it could be.

the_wolverine
Champion

The Splunk License Usage app written by Splunk user, joshs, is a very useful app for this purpose. It can be downloaded directly from Splunkbase: http://www.splunkbase.com/apps/All/4.x/App/app:Splunk+License+Usage

If your Splunk instance has access to the Internet, you can install the app from the UI by doing the following:

1) Log into your Splunk UI as an Admin user.

2) Go to Manager >> Apps >> and click on "Browse Splunkbase for more apps.."

3) Browse to the Splunk License Usage app and download it (You will need a registered login username/password for Splunk.com - this is different from any login on your Splunk instance.)

There is no need to restart Splunk. You can start making use of the app's custom searches and dashboards immediately by browsing to the App in Splunk UI.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...