Installation

Why did Splunk use up our ingest bandwidth?

adepasquale
Path Finder

Last night a received an alert that we went over our bandwidth Cap. Upon closer inspection, I saw a new "host" in the 30 day license chart... the host was SPLUNK. I ran this command (same as the 30 day license command) only i limited it to just Splunk

index=_internal 
    [ `set_local_host`] source=*license_usage.log* type="Usage" h="SPLUNK"
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) 
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) 
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
| bin _time span=1d 
| stats sum(b) as b by _time, pool, s, st, h, idx 
| timechart span=1d sum(b) AS volumeB by h fixedrange=false 
| join type=outer _time 
    [ search index=_internal 
        [ `set_local_host`] source=*license_usage.log* type="RolloverSummary" earliest=-30d@d 
    | eval _time=_time - 43200 
    | bin _time span=1d 
    | stats latest(stacksz) AS "stack size" by _time] 
| fields - _timediff 
| foreach * 
    [ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]

This report shows that Splunk NEVER logs anything towards our ingest limit... until yesterday where it indexed .25 GB of data. What would cause this?

Labels (1)
0 Karma
1 Solution

dflodstrom
Builder

Are you able to share the source or sourcetype(s) of these events? Is it possible that someone added something like the TA for unix which contains inputs?

View solution in original post

dflodstrom
Builder

Are you able to share the source or sourcetype(s) of these events? Is it possible that someone added something like the TA for unix which contains inputs?

adepasquale
Path Finder

Never mind.... just saw that someone added data to splunk using the drag and drop add data feature that day!

adepasquale
Path Finder

Sure none of this data is sensitive so just let me know what commands you'd like to see run. What is interesting is if i just search for the host "SPLUNK" i get a lot of audit data.. how would a limit that search to just stuff that counts against our ingest limit.

also, I'm really the only one who uses this machine and i don't see any add-ons recently installed.

0 Karma

dflodstrom
Builder

Data logged to internal indexes (_internal, _audit, _introspection) should not count against your license. Try this (start the search with the pipe) "| tstats count WHERE index=* host= by source"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...