Installation

metrics.log and license usage

Fam_Inv
New Member

Hi

Hopefully someone can help. We are seeing our daily license usage being eaten up by metrics.log. Im not a Splunk expert so I don't really know what I need to do here but I know that I don't want a Splunk internal log using up my expensive Enterprise license!

Can I just remove it from the Data Inputs section in Manager or will that have an adverse effect on Splunk?

Thanks

Simon

Tags (2)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

That log doesn't use your license, unless you b0rked something and aren't indexing to _internal index. Me thinks you have a data source somewhere else that is eating your license. Use the metrics.log or the license usage log to determine what is up. Use the search below to determine what sourcetype has the highest indexing rate. To determine source, use by s instead.

index=_internal source=*usage.log type=Usage earliest=@d| timechart span=10m sum(b) as b by st

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

That log doesn't use your license, unless you b0rked something and aren't indexing to _internal index. Me thinks you have a data source somewhere else that is eating your license. Use the metrics.log or the license usage log to determine what is up. Use the search below to determine what sourcetype has the highest indexing rate. To determine source, use by s instead.

index=_internal source=*usage.log type=Usage earliest=@d| timechart span=10m sum(b) as b by st

Fam_Inv
New Member

Ok thanks for your help. That probably explains it

I initially started looking into a way of getting Splunk to alert me when it was getting close to using up its license. I noticed that the internal splunk logs were being indexed so figured I could create a search based on that log however I couldn't find anything meaningful in the license usage logs

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...