Guide

How to check Splunk license usage by index, sourcetype and host

Updated November 3, 2026 · Ayrix Labs

Short answer: Search the license manager's license_usage.log: index=_internal source=*license_usage.log* type=Usage | stats sum(b) by idx gives bytes per index. Split by st for sourcetype or h for host, and use type=RolloverSummary for each day's total against the quota.

Where license usage is recorded

The license manager writes type=Usage events every minute or so for each indexer and each combination of index (idx), sourcetype (st), host (h) and source (s), with the bytes counted in b. At midnight it writes a type=RolloverSummary event with the previous day's total (b) and the stack size (stacksz). Run these searches where the license manager's _internal data is searchable, usually the Monitoring Console or a search head that searches the license manager.

License usage by index today

index=_internal source=*license_usage.log* type=Usage earliest=@d
| stats sum(b) as bytes by idx
| eval GB=round(bytes/1024/1024/1024, 2)
| sort - GB
| fields idx GB

Daily license usage by index for 30 days

index=_internal source=*license_usage.log* type=Usage earliest=-30d@d latest=@d
| eval GB=b/1024/1024/1024
| timechart span=1d limit=0 useother=false sum(GB) by idx

limit=0 keeps every index instead of folding the small ones into OTHER. Indexes with no data in the window do not appear, and internal indexes such as _internal do not count against the license.

By sourcetype or host

index=_internal source=*license_usage.log* type=Usage earliest=-7d@d
| stats sum(b) as bytes by st
| eval GB=round(bytes/1024/1024/1024, 2)
| sort - GB

Replace st with h for host or s for source. If many rows show an empty host or source, the license manager squashed them: past a threshold of distinct host and source values it records usage by index and sourcetype only. Index and sourcetype totals stay exact.

Daily total against your license quota

index=_internal source=*license_usage.log* type=RolloverSummary earliest=-30d@d
| eval day=strftime(_time - 86400, "%Y-%m-%d")
| stats latest(b) as b latest(stacksz) as stacksz by day, slave, pool
| stats sum(b) as b max(stacksz) as stacksz by day
| eval used_GB=round(b/1024/1024/1024, 2), quota_GB=round(stacksz/1024/1024/1024, 2), pct=round(used_GB/quota_GB*100, 1)

RolloverSummary is written once per indexer (slave) and pool just after midnight on the license manager's clock, so it describes the day before: the search sums across indexers and the day field shifts the date back.

Find what grew

index=_internal source=*license_usage.log* type=Usage earliest=-14d@d latest=@d
| eval week=if(_time >= relative_time(now(), "-7d@d"), "this_week", "last_week")
| chart sum(b) over st by week
| fillnull value=0 this_week last_week
| eval change_GB=round((this_week - last_week)/1024/1024/1024, 2)
| sort - change_GB

In the Monitoring Console

Splunk Enterprise: Settings, Monitoring Console, Indexing, License Usage, Historic License Usage, then split by index, sourcetype, host or source. Splunk Cloud Platform shows ingest-based license usage in the Cloud Monitoring Console; workload-based subscriptions are measured differently.

License warnings

Splunk records a warning on a day when indexed volume exceeds the license. What happens after repeated warnings depends on your license type and Splunk version, so check Settings, Licensing and Splunk's licensing documentation for yours.

How Drew helps

Ask Drew "which indexes used the most license yesterday, and what changed from last week?" in Slack. Drew runs searches like the ones above against your license manager, answers with a table or chart, and marks the answer Verified when the figures come from a search it ran in that turn.

• Answers from your own Splunk. Ask in plain English in Slack or the web app. Drew runs the SPL searches through your Splunk MCP Server and answers with text, tables or charts.
• Says whether each answer was checked. Every answer that states figures is marked Verified (a search this turn returned the data), Likely (figures from an earlier search, with when) or Not checked. The label is decided by code from what actually ran, not by the model.

Drew is taking a small group of MSPs, Splunk teams and consultants into early access. Request access or email hello@rundrew.com.