Installation

metrics.log and license usage

Fam_Inv
New Member

Hi

Hopefully someone can help. We are seeing our daily license usage being eaten up by metrics.log. Im not a Splunk expert so I don't really know what I need to do here but I know that I don't want a Splunk internal log using up my expensive Enterprise license!

Can I just remove it from the Data Inputs section in Manager or will that have an adverse effect on Splunk?

Thanks

Simon

Tags (2)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

That log doesn't use your license, unless you b0rked something and aren't indexing to _internal index. Me thinks you have a data source somewhere else that is eating your license. Use the metrics.log or the license usage log to determine what is up. Use the search below to determine what sourcetype has the highest indexing rate. To determine source, use by s instead.

index=_internal source=*usage.log type=Usage earliest=@d| timechart span=10m sum(b) as b by st

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

That log doesn't use your license, unless you b0rked something and aren't indexing to _internal index. Me thinks you have a data source somewhere else that is eating your license. Use the metrics.log or the license usage log to determine what is up. Use the search below to determine what sourcetype has the highest indexing rate. To determine source, use by s instead.

index=_internal source=*usage.log type=Usage earliest=@d| timechart span=10m sum(b) as b by st

Fam_Inv
New Member

Ok thanks for your help. That probably explains it

I initially started looking into a way of getting Splunk to alert me when it was getting close to using up its license. I noticed that the internal splunk logs were being indexed so figured I could create a search based on that log however I couldn't find anything meaningful in the license usage logs

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...