https://community.splunk.com/t5/Splunk-Enterprise/Am-I-sending-License-data-from-the-indexer-to-the-SH-and-then/m-p/586476#M11671 <P>It's not the same data.&nbsp; The indexers are sending usage information to the LM (SH).&nbsp; The LM is then saves that usage (in a different format) in a log file that is written to the indexers.</P> Thu, 24 Feb 2022 18:59:40 GMT richgalloway 2022-02-24T18:59:40Z https://community.splunk.com/t5/Splunk-Enterprise/Am-I-sending-License-data-from-the-indexer-to-the-SH-and-then/m-p/586466#M11670 <P>Hi</P> <P>I have configured a 3INX 1SH 1MN cluster.</P> <P>I have activated the license master on the SH, I have noticed that the "index=_internal source=*license_usage.log" Is only available on the SH, meaning the data from the indexes are being sent from the indexers to the SH.</P> <P>I am reading this document about how we should send all _internal data to the Indexers?</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.0.1/Indexer/Forwardmasterdata?_ga=2.199674158.1222254230.1645723900-1328632051.1639410282" target="_blank" rel="noopener">https://docs.splunk.com/Documentation/Splunk/7.0.1/Indexer/Forwardmasterdata?_ga=2.199674158.1222254230.1645723900-1328632051.1639410282</A></P> <P>So, when I activated this, am I not sending back the same data that the indexers have just sent me?</P> <P>Or does something happen where the data is not sent at all?</P> <P>Thanks in advance</P> <P>Rob&nbsp;</P> Thu, 24 Feb 2022 18:41:13 GMT https://community.splunk.com/t5/Splunk-Enterprise/Am-I-sending-License-data-from-the-indexer-to-the-SH-and-then/m-p/586466#M11670 robertlynch2020 2022-02-24T18:41:13Z https://community.splunk.com/t5/Splunk-Enterprise/Am-I-sending-License-data-from-the-indexer-to-the-SH-and-then/m-p/586476#M11671 <P>It's not the same data.&nbsp; The indexers are sending usage information to the LM (SH).&nbsp; The LM is then saves that usage (in a different format) in a log file that is written to the indexers.</P> Thu, 24 Feb 2022 18:59:40 GMT https://community.splunk.com/t5/Splunk-Enterprise/Am-I-sending-License-data-from-the-indexer-to-the-SH-and-then/m-p/586476#M11671 richgalloway 2022-02-24T18:59:40Z https://community.splunk.com/t5/Splunk-Enterprise/Am-I-sending-License-data-from-the-indexer-to-the-SH-and-then/m-p/586816#M11700 <P>ok - thanks</P> Mon, 28 Feb 2022 10:13:48 GMT https://community.splunk.com/t5/Splunk-Enterprise/Am-I-sending-License-data-from-the-indexer-to-the-SH-and-then/m-p/586816#M11700 robertlynch2020 2022-02-28T10:13:48Z