I have a 50GB splunk license running on a single Splunk Search/indexer server (host=splunkprod), my total usage peaks about 41GB per day, I noticed that the Splunk host (splunkprod) uses about 4GB in 24hr period of my total 41GB used. Why is this so high. When I run a query on the events there are only 2 data sources and 28,530 events in that 24hr period.
As I understand it Splunk licesense only counts against data flowing into splunk over a 24hr period, are there other factors that contribute to this 4GB usage?
Your search is counting volume from the Splunk logs, which don't count against your license.
Try this search:
index=_internal source=*license_usage.log type=Usage
| stats sum(b) as bytes by h
| eval MB = round(bytes/1024/1024,1)
| fields h MB
My query comes up with 1.596 GB and your query came up to 29MB, we are wondering if the lic usage.log does not track local host monitoring?
Your search is counting volume from the Splunk logs, which don't count against your license.
Try this search:
index=_internal source=*license_usage.log type=Usage
| stats sum(b) as bytes by h
| eval MB = round(bytes/1024/1024,1)
| fields h MB
I am using this query to find measure which hosts are sending the most throughput that counts against our splunk license. It show 1.596GB using a search time of yesterday
host=* index=_internal group="per_host_thruput" | eval mb=kb/1024| stats sum(mb) by series | where ('sum(mb)'>300) |sort by sum
How are you getting the 4GB number?