I have been using the following to give me a estimate of license usage for the day:
index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" earliest=@d+30M | eval GB=b/1024/1024/1024 | search | stats sum(GB) by pool | eval used='sum(GB)' | eval GB_Used_Today=round(used, 0) | fields GB_Used_Today
This search used to match fairly closely to what the manager would report under licensing, but now the search above is always much higher?
Does anyone know what the search is that the manager->>licensing uses?
Yesterday
index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" NOT type=RolloverSummary | eval GB=b/1024/1024/1024 | search | stats sum(GB) by pool | eval used='sum(GB)' | eval GB_Used_Today=round(used, 0) | fields GB_Used_Today
186gb
index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" | eval GB=b/1024/1024/1024 | search | stats sum(GB) by pool | eval used='sum(GB)' | eval GB_Used_Today=round(used, 0) | fields GB_Used_Today
248gb
index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" type=RolloverSummary | eval GB=b/1024/1024/1024 | search | stats sum(GB) by pool | eval used='sum(GB)' | eval GB_Used_Today=round(used, 0) | fields GB_Used_Today
62gb
Today
index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" NOT type=RolloverSummary | eval GB=b/1024/1024/1024 | search | stats sum(GB) by pool | eval used='sum(GB)' | eval GB_Used_Today=round(used, 0) | fields GB_Used_Today
66gb
index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" | eval GB=b/1024/1024/1024 | search | stats sum(GB) by pool | eval used='sum(GB)' | eval GB_Used_Today=round(used, 0) | fields GB_Used_Today
156gb
index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" type=RolloverSummary | eval GB=b/1024/1024/1024 | search | stats sum(GB) by pool | eval used='sum(GB)' | eval GB_Used_Today=round(used, 0) | fields GB_Used_Today
89gb
From the license manager I am seeing 66gb
What calculation is the manager using???
Either exclude ("NOT type=RolloverSummary") or include only ("type=RolloverSummary") the RolloverSummary type from the original search. Otherwise, IIRC, you will measure close to double the usage volume.
OK, it looks like the correct answer is to exclude the RolloverSummary type ("NOT type=RolloverSummary").