I'm search MB Receiveied in the Deployment Monitor, License Usage. Search by Indexer seems has a lot higher MB than search by License Pool. Is it because License pool's data is compressed?
Known issue :
"Deployment Monitor" app's "By License Pool" report shows nearly double the daily usage than "By Indexer" Report. (SPL-49519)
Until the deployment-monitor app is fixed, the best way to measure the actual license volume is to use this search on the license-master (or on the search-head, if it 's a search-peer)
index=_internal source=*license_usage* type=RolloverSummary | bucket _time span=1d | stats sum(b) AS volume by _time pool
Known issue :
"Deployment Monitor" app's "By License Pool" report shows nearly double the daily usage than "By Indexer" Report. (SPL-49519)
Until the deployment-monitor app is fixed, the best way to measure the actual license volume is to use this search on the license-master (or on the search-head, if it 's a search-peer)
index=_internal source=*license_usage* type=RolloverSummary | bucket _time span=1d | stats sum(b) AS volume by _time pool
This is fixed in version 5.0.0/5.0.1 of the app:
http://splunk-base.splunk.com/apps/67836/splunk-deployment-monitor
This seems to apply to the numbers on the License Report as well.
It shows approximately twice the volume of S.o.S's license reports.
This is a known issue with the app (SPL-49519) which we are fixing for the next release which is forthcoming.
for the explanation of the double counting, see this guide :
http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume