we have a license for our QA environment for 500MB. We wanted to have the same functions (deployment, alerts, security) as our production implementation but not the volume, so we can test out new data inputs, reports, etc. before pushing to production.
anyway, last week the license in our QA environment exceeded its limit, so we needed to get it reset. not a big deal. but when i run the following search over a 7 day period:
index="_internal" group="per_index_thruput" | search series!="_audit" | search series!="_internal"| eval mb=kb/1000 | timechart span="24h" sum(mb)
result
_time sum(mb)
2010-09-13T00:00:00.000+00:00 113.5911238
2010-09-14T00:00:00.000+00:00 148.8340241
2010-09-15T00:00:00.000+00:00 199.217649
2010-09-16T00:00:00.000+00:00 168.5147037
2010-09-17T00:00:00.000+00:00 168.3872045
2010-09-18T00:00:00.000+00:00 126.0590347
2010-09-19T00:00:00.000+00:00 131.917827
2010-09-20T00:00:00.000+00:00 59.22617381
i don't see us exceeding our license limit of 500MB per day. I'm assuming the _internal and _audit indexes do not count against the license. if that is true, then why did our license trip? is something wrong with my search?
thanks,
... View more