https://community.splunk.com/t5/Deployment-Architecture/Splunk-internal-logs-consuming-license/m-p/236959#M21520 <P>Hi Team,</P> <P>I have 5 GB enterprise license.We have created 8 indexes in splunk. From few days there were no data observed on created indexes,<BR /> but still license has been used and we met license violation.<BR /> I am not able to find any data on search head. Does that mean the _internal logs consuming license.?<BR /> Anyone faced this issue?<BR /> Please suggest a solutions?</P> <P>Thnaks &amp; Regards,<BR /> Kalyani</P> Thu, 12 Jan 2017 13:28:01 GMT kalyanilandge 2017-01-12T13:28:01Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-internal-logs-consuming-license/m-p/236959#M21520 <P>Hi Team,</P> <P>I have 5 GB enterprise license.We have created 8 indexes in splunk. From few days there were no data observed on created indexes,<BR /> but still license has been used and we met license violation.<BR /> I am not able to find any data on search head. Does that mean the _internal logs consuming license.?<BR /> Anyone faced this issue?<BR /> Please suggest a solutions?</P> <P>Thnaks &amp; Regards,<BR /> Kalyani</P> Thu, 12 Jan 2017 13:28:01 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-internal-logs-consuming-license/m-p/236959#M21520 kalyanilandge 2017-01-12T13:28:01Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-internal-logs-consuming-license/m-p/236960#M21521 <P>All internal indexes (<EM>internal and all other index names starting with '</EM>') do not count against your license. If you have a license violation then you must have ingested more than 5GB into your indexes. Use the Monitoring Console to run License Usage and Index Detail reports. They should help identify the source of the violation.</P> Thu, 12 Jan 2017 13:52:38 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-internal-logs-consuming-license/m-p/236960#M21521 richgalloway 2017-01-12T13:52:38Z