How is the Splunk license measured?

[hrithiktej]

The reason I ask this is because I recently installed UFs on one of my DC and daily license has gone up by 15-20 GB but I don't see that much data coming into it.

Events like 4,624 have the line count as 63 (seen from the interesting field column) and I read somewhere that Splunk license count is based on the line count field, which means 1 event of 4624 is counted as 63 events because of line count.

[s2_splunk · Accepted solution]

Splunk licensing is metered in bytes at the time an event is written to disk. If your event is 4624 Bytes, you will consume 4624 bytes of your license. This licensed volume is a per day (midnight to midnight) volume.
With the introduction of metrics data store in V7.0, this is slightly changed. For metrics, each event will be licensed as 150Bytes, independent of the actual size of the metrics data event.

Note that it is NOT based on event count, nor is it based on how much data you send to an indexer tier. If the indexer modifies the event data (masking, filtering, etc.), only the data that is actually written to disk counts towards your license.

HTH

[hrithiktej]

ok, thanks,

Will upgrading to 7.0 spike my license usage since every event in it will be counted as fixed 150bytes?

[gjanders]

No, only metric data which is a new type of index uses the alternative 150 bytes/metric measurement...

[hrithiktej]

oh ok thanks

[yannK]

Remember that this is the size of the "raw" event. Not the size of the compressed event on disk, and not the meta fields that may exists.

Remark : since splunk 7.*, there is a new type of data for "metrics" events.
And those have a fix license size cost per event

Unlike event data, metrics data counts against a license at a fixed 150 bytes per metric event. Metrics data does not have a separate license. Ingesting metrics data draws from the same license quota as event data.

see http://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/HowSplunklicensingworks#How_metrics_data_is_...