All Apps and Add-ons

How to generate a search to determine why our license usage doubled?

avalle
Path Finder

Over the holiday weekend our license usage doubled and I need to figure out what is causing this. I have S.o.S - Splunk on Splunk installed but I am not sure if this is where I find this information. anyone have any searches to determine what devices started sending data or volume change?

0 Karma
1 Solution

woodcock
Esteemed Legend

Try running these searches for the last 10 days:

| tstats count GroupBy index _time span=1d 
| timechart span=1d sum(count) BY index

Get more granular with this:

| tstats count GroupBy sourcetype index _time span=1d 
| eval entity = sourcetype . "/" . index 
| timechart span=1d sum(count) BY entity

Get the most granularity with this:

| tstats count GroupBy host sourcetype index _time span=1d 
| eval entity = host . "/" . sourcetype . "/" . index 
| timechart span=1d sum(count) BY entity

These will chart changes in # of events, but if the problem is that this metric is more or less the same and the problem is that the average size of a particular event has increased, then it will not be evident.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Try running these searches for the last 10 days:

| tstats count GroupBy index _time span=1d 
| timechart span=1d sum(count) BY index

Get more granular with this:

| tstats count GroupBy sourcetype index _time span=1d 
| eval entity = sourcetype . "/" . index 
| timechart span=1d sum(count) BY entity

Get the most granularity with this:

| tstats count GroupBy host sourcetype index _time span=1d 
| eval entity = host . "/" . sourcetype . "/" . index 
| timechart span=1d sum(count) BY entity

These will chart changes in # of events, but if the problem is that this metric is more or less the same and the problem is that the average size of a particular event has increased, then it will not be evident.

0 Karma

avalle
Path Finder

Thank you! this helped determine what index doubled in size. How do i run these searches for that particular index? I tried adding index=XXX but the search did not like it at all

0 Karma

woodcock
Esteemed Legend

Also, check out the Meta Woot! app:

https://splunkbase.splunk.com/app/2949/

0 Karma

avalle
Path Finder

Oh this looks like a great app!!! do i have to install it in all HF and indexers? I installed in the search head and no data came up.

0 Karma

woodcock
Esteemed Legend

After the tstats line add this line:

| search index="XXX"
0 Karma

avalle
Path Finder

NICE! that worked!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...