Hi,
I can see the usage report, but my question is: how is it determined? Is it byte for byte against my source data? (ie "Hello World" == 11 bytes)?
I'm asking because I changed the INDEXED_EXTRACTIONS setting in my props.conf from undefined to w3c and my license usage shot up through the roof. From my usual .3gb a day to 1.4. Did all these extra fields cost me extra?
Thanks,
Rob
Hi robertlabrie,
usually adding extra fields does not add more license usage. License usage is based on the size of the _raw
data. I cannot tell you exactly how Splunk determines the raw data size, but you can do some search-fu to verify it with your data.
Roughly, you can run a search where you look at your data over a range of indexed_time values, counting up the size of the actual events. Take this run everywhere example to get the _raw
data size per source
index=_internal | eval event_size=len(_raw) | timechart sum(event_size) as event_size by source
This is a slow and expensive search and it must be run across a time range that can contain all possible events that were indexed at that time -- meaning regardless of timestamp regularity. Typically this means it must be run over all time.
hope this helps ...
cheers, MuS