Get License Usage Through Custom Script

[mullinsben]

I'm trying to pull the license usage with a script on my Splunk server and send a notification to Teams (along with a bunch of other information about my server along with it). I did some research, and found the license_usage.log files. There were 6 files. I was guessing b=integer was the number of bytes used, so I threw together a python script to add up all of those bytes listed in all 6 files, and got 68GB. My actual usage was 52 GB. my license_usage.log.3 had 54GB in it, but that was as close as I could come to the actual 52GB. I'm assuming I'm not looking in the correct place, or I'm adding up multiple days. I've combed Splunk documentation for what these files are, but all I'm finding is a bunch of the same Splunk query that says something about accessing this file and taking the sum of b to get the license usage.

Does anyone know how I can just pull the license usage from yesterday without running a query in Splunk? I know I can just run the query remotely with a script and use the output, but I would like to do it this way instead if it's possible.

[FrankVl]

If you're just interested in yesterday's license usage and prefer to get it from the files, rather than by querying splunk. Look at the lines in those files that contain type=RolloverSummary. Those lines occur right after midnight and contain the bytes (b) ingested in the past day. If it is a single instance with a single license stack, there should be 1 event per day like that.

And that may also explain why you were getting weird results, as the license_usage.log contains (at least) 3 different types of events:
- Usage: every minute one event per index/source/sourcetype/host combo with bytes (b) ingested in past minute
- RolloverSummary: daily summary as described above
- SlaveWarnSummary: something else, not containing license usage info
So if you sum the b field, without taking into account those different types of logs, you will be summing 'live' usage logs together with the daily summary.