My Splunk Usage Report is showing an abnormally high amount of usage given how early it is in the day. I took a look around, and noticed on the 30 day historical report no usage is being shown for yesterday. I also ran this query:
index="_internal" source="*metrics.log" per_index_thruput | eval GB=kb/(1024*1024) | timechart span=1d sum(GB) | convert ctime(_time) as timestamp
And it shows me that we used 37GB yesterday and 12GB so far today, which adds up to the current usage showing of 49GB today. We should be seeing something closer to that 12GB rather than the 49GB I am seeing. So my belief is that our daily license usage has not reset for the new day. I am worried if today gets too high we will get flagged for exceeding our license limit. Has anyone seen this before? What's the best way to trigger the License Usage Report to roll over to the proper day?
↧