Installation

Why am I getting conflicting numbers for the Trial license usage?

vanvan
Path Finder

Hi,

I am running a Splunk Enterprise server v.7.1.0 with the trial license (500MB/day) and was just given a violation warning that I've exceeded the daily allowance.

When I go to the License Manager screen I see that I have used 600+ MB for the day, but when I go to the Indexes page I see that the current size of the index is 130 MB total.

What am I missing here?

Labels (1)
0 Karma
1 Solution

Ayn
Legend

The figure you see is how much storage the index uses. Data is compressed before it is stored, so 130MB does not mean that you only have 130MB worth of uncompressed raw data.

View solution in original post

0 Karma

Ayn
Legend

The figure you see is how much storage the index uses. Data is compressed before it is stored, so 130MB does not mean that you only have 130MB worth of uncompressed raw data.

0 Karma

p_gurav
Champion

Can you try below search to check index volume:

index=_internal source=*license_usage.log type=Usage
| fields idx, b
| rename idx as index_name
| timechart span=1d limit=20 sum(eval(round(b/1024/1024,4))) AS Total_MB by index_name
0 Karma

vanvan
Path Finder

Thanks! I've tried and this shows the 600+ MB value that is in violation.
Why is it different than the value reported in the Settings -> Indexes page?

BTW I deleted the events from the index and it is still reporting the same value. Is there a process that updates the reported value?

0 Karma

p_gurav
Champion

Did you restart splunk after deleting events?

The current size shows the index size on disk which after splunk data compression process.

0 Karma

vanvan
Path Finder

Yes,

I restarted the server but nothing changed in both values...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...