Splunk Search

Incorrect License Usage being returned

rmcdougal
Path Finder

I am attempting to setup an alert to warn me of license usage but I am receiving bogus information back. This is search that I am running.

index=_internal source=license_usage pool="auto_generated_pool_enterprise" | eval GB=b/1024/1024/1024 | stats sum(GB) by pool

For example, this returns back 18.63GB this morning when in actuality by looking at the licensing page I have only used 4.7GB.

I assume that this has something to do with my setup which is 2 SearchHeads with one of the searchheads serving as a license master and 2 indexers.

Any ideas?

Tags (2)
1 Solution

tiny3001
Path Finder

I know this is an old question, but I ran into this exact same problem recently, and this is how I solved it:

index=_internal source="*license_usage.log" pool="auto_generated_pool_enterprise" type="Usage" | eval GB=b/1024/1024/1024 | stats sum(GB) by pool

By limiting it to type="Usage", you are excluding events like "RolloverSummary", which includes the total for a specific day calculated at midnight every night.

That should bring back the accurate license usage for a given time period.

View solution in original post

tiny3001
Path Finder

I know this is an old question, but I ran into this exact same problem recently, and this is how I solved it:

index=_internal source="*license_usage.log" pool="auto_generated_pool_enterprise" type="Usage" | eval GB=b/1024/1024/1024 | stats sum(GB) by pool

By limiting it to type="Usage", you are excluding events like "RolloverSummary", which includes the total for a specific day calculated at midnight every night.

That should bring back the accurate license usage for a given time period.

tiny3001
Path Finder

Thanks, I fixed it up to be exactly how we use it at the moment.

0 Karma

sowings
Splunk Employee
Splunk Employee

Couple of comments:

I think you may need "source=*license_usage.log".

If you move the eval after the sum, the eval will run fewer times (over fewer rows), making the search somewhat more efficient. I don't think it will matter much for this particular search, but you may find the principle useful.

0 Karma

rmcdougal
Path Finder

I think I figured out a solution but I am not sure why... In the license_Usage.log file there is a field labled i=6E00304....... There were three of these values, if I only search for two of the values it returns the correct number.

0 Karma

sowings
Splunk Employee
Splunk Employee

Those are the GUIDs of the indexers (which in this case could be a SH too, if it's generating data, or forwarding something other than its internal logs). They can be found by | rest /services/configs/conf-server/general and examining the guid field. Note that this assumes that all of the indexers reporting to the license master are search peers of one another. If that's not the case, you may have "unresolved" GUIDs--those for which the | rest search command can't get results.

0 Karma

rmcdougal
Path Finder

It only returned a value of 25 MB for three days ago.

0 Karma

sdaniels
Splunk Employee
Splunk Employee

How does this compare?

index=_internal todaysbytesindexed startdaysago=30 | eval MB_Indexed = todaysBytesIndexed/1024/1024 | stats sum(MB_Indexed) by date_mday,date_month,date_year

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...