All,
We noticed something very strange with our reporting. We have recently transitioned to an indexer cluster. We have always had a report that is sent out with yesterdays license usage totals. However, a day after transitioning our reports now show double the license consumption when running searches like : index=_internal source="*license_usage.log" sourcetype=splunkd type="Usage" | stats sum(b) as bytes| eval GB=round(bytes/1024/1024/1024) |fields GB| rename poolszg as "Daily License Quota" GB as "Daily License Quota Used"
Our repfactor and search factor is both set at 2 which correlates with the doubling we see per index.
What seemed to correct our reports was disabling repFactor = auto and setting it to repFactor=0 for the _internal index found under the _cluster app. Since disabling this, our license consumption now matches the trend we were seeing prior to the cluster move.
Has anyone else had this issue with inaccurate license totals when having repFactor=auto set on _internal index?
↧