Monitoring Splunk

What is the best way to measure current license usage?

fhlbcsplunkbase
Explorer

While trying to root cause a huge influx of logs into my instance I noticed that querying my current license usage through the license pool differs greatly when compared to the actual License_Usage.log statistics.

The search below give mes one number

index=_internal source=/opt/splunk/var/log/splunk/license_usage.log type=Usage
| rename b AS bytes st AS source_type idx AS index 
| stats sum(bytes) AS total
| eval total=round(total/1024/1024/1024,2)

While this search gives me a number roughly twice as high as the previous measurement

| rest splunk_server= /services/licenser/pools
| search description=auto_generated_pool_enterprise
| table used_bytes 
| eval total=round(used_bytes/1024/1024/1024,2)

Does anyone know why I would be seeing the disparity when searching the exact same time frame?

0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

Splunk REST endpoints are not time picker aware therefore you may be seeing a difference because of this...

View solution in original post

gjanders
SplunkTrust
SplunkTrust

Splunk REST endpoints are not time picker aware therefore you may be seeing a difference because of this...

fhlbcsplunkbase
Explorer

That is a good point. I don't suppose you'd know what the default behavior of the REST methods are in terms of time range? The documentation is pretty parse on details there.

0 Karma

fhlbcsplunkbase
Explorer

Your answer got me on the right path gjanders. The rest call was looking over today in UTC, while the search was running on the search head in central time. Thanks!

gjanders
SplunkTrust
SplunkTrust

No problem, thanks for accepting. The REST endpoints usually don't have the concept of a time range (for many of them), therefore you have to check on the endpoint what happens...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...