Installation

metrics.log and license usage

Fam_Inv
New Member

Hi

Hopefully someone can help. We are seeing our daily license usage being eaten up by metrics.log. Im not a Splunk expert so I don't really know what I need to do here but I know that I don't want a Splunk internal log using up my expensive Enterprise license!

Can I just remove it from the Data Inputs section in Manager or will that have an adverse effect on Splunk?

Thanks

Simon

Tags (2)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

That log doesn't use your license, unless you b0rked something and aren't indexing to _internal index. Me thinks you have a data source somewhere else that is eating your license. Use the metrics.log or the license usage log to determine what is up. Use the search below to determine what sourcetype has the highest indexing rate. To determine source, use by s instead.

index=_internal source=*usage.log type=Usage earliest=@d| timechart span=10m sum(b) as b by st

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

That log doesn't use your license, unless you b0rked something and aren't indexing to _internal index. Me thinks you have a data source somewhere else that is eating your license. Use the metrics.log or the license usage log to determine what is up. Use the search below to determine what sourcetype has the highest indexing rate. To determine source, use by s instead.

index=_internal source=*usage.log type=Usage earliest=@d| timechart span=10m sum(b) as b by st

View solution in original post

Fam_Inv
New Member

Ok thanks for your help. That probably explains it

I initially started looking into a way of getting Splunk to alert me when it was getting close to using up its license. I noticed that the internal splunk logs were being indexed so figured I could create a search based on that log however I couldn't find anything meaningful in the license usage logs

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!