How to determine daily license usage in GB?

Question

What's a search I can run to quickly see my daily license usage in GB?

Accepted Answer

2

index=_internal todaysbytesindexed startdaysago=30 | eval GB_Indexed = todaysBytesIndexed/1024/1024/1024 | timechart span=1d avg(GB_Indexed)

This search is included in the Search App's set of bundled indexing-related searches as of version 4.1.4.

link

answered 21 Jul '10, 16:54

the_wolverine ♦
4.3k●5●8●43
accept rate: 50%

Accepted Answer

Also, you can find on SplunkBase the Splunk License Usage Apps.

In addition to the daily license usage, this Splunk Apps provides a dashboard of your Splunk license usage total over the past 24 hours as well as usage by host, source, and sourcetype. It contains timecharts to help you understand usage over time and see usage spikes as well as pie charts to help you to figure out which log files, sourcetypes, and hosts Splunk is indexing the most data from.

Answer 3

This has been answered several times, but here are searches I use.

daily total by GB:

index="_internal" source="*metrics.log" per_index_thruput | eval GB=kb/(1024*1024) | timechart span=1d sum(GB) | convert ctime(_time) as timestamp

highest-usage indexes:

index="_internal" source="*metrics.log" per_index_thruput | eval GB=kb/(1024*1024) | stats sum(GB) as total by series date_mday | sort total | fields + date_mday,series,total | reverse

Answer 4

1

A simple way to do this, adapting @wolverine's search above:

index=_internal todaysbytesindexed startdaysago=30 | eval MB_Indexed = todaysBytesIndexed/1024/1024 | stats sum(MB_Indexed) by date_mday,date_month,date_year

This will provide a table of usage over time, broken out in a table by date

link

answered 10 Aug '10, 22:47

Justin Grant
1.5k●6●7●40
accept rate: 50%

Answer 5

Similar to Tedder's, here are the searches I always use to see a nice graphical view of indexing in Advanced Charting view, last 24 hours:

Today's indexing by sourcetype:

index="_internal" source="*metrics.log" per_sourcetype_thruput | eval MB=kb/1024 | timechart span=10m sum(MB) by series

Today's indexing by index:

index="_internal" source="*metrics.log" per_index_thruput | eval MB=kb/1024 | timechart span=10m sum(MB) by series

If certain sourcetypes/indexes are too big, you can use the Y axis log-scale option, or exclude them, such as Today's non-internal indexing by sourcetype:

index="_internal" source="*metrics.log" per_sourcetype_thruput NOT series=splunkd NOT series=stash | eval MB=kb/1024 | timechart span=10m sum(MB) by series

Answer 6

0	Beware, in 4.2 and in 4.3, the license metrics log files format changed. please update your searches according to this guide : http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume link answered 29 Feb, 20:15 yannK 3.8k●4●7 accept rate: 33%

How to determine daily license usage in GB?

Follow this question

Splunk Resources

Related questions