https://community.splunk.com/t5/Getting-Data-In/Why-License-Usage-has-empty-fields/m-p/626384#M107608 <P>Hi guys.<BR />I was asking why my reports, using license_usage.log from LicenseMaster, for "LicenseUsage" sometimes do not log the "h" or "s" field (alias from host or from source).<BR />Doing so, i can have a full report for Indexers or Sourcetypes usage, but not for Host or Sources.</P><P>&nbsp;</P><LI-CODE lang="markup">INFO LicenseUsage - type=Usage s="" st="MY_ST" h="" o="" idx="MY_IDX" i="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" pool="auto_generated_pool_enterprise" b=51331 poolsz=214748364800</LI-CODE><P>&nbsp;</P><P>May it be the origin forwarder version? I have forwarders from 6.x.x to 8.x.x version running.</P><P>Any clue? Thanks.</P> Tue, 10 Jan 2023 06:48:52 GMT verbal_666 2023-01-10T06:48:52Z https://community.splunk.com/t5/Getting-Data-In/Why-License-Usage-has-empty-fields/m-p/626384#M107608 <P>Hi guys.<BR />I was asking why my reports, using license_usage.log from LicenseMaster, for "LicenseUsage" sometimes do not log the "h" or "s" field (alias from host or from source).<BR />Doing so, i can have a full report for Indexers or Sourcetypes usage, but not for Host or Sources.</P><P>&nbsp;</P><LI-CODE lang="markup">INFO LicenseUsage - type=Usage s="" st="MY_ST" h="" o="" idx="MY_IDX" i="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" pool="auto_generated_pool_enterprise" b=51331 poolsz=214748364800</LI-CODE><P>&nbsp;</P><P>May it be the origin forwarder version? I have forwarders from 6.x.x to 8.x.x version running.</P><P>Any clue? Thanks.</P> Tue, 10 Jan 2023 06:48:52 GMT https://community.splunk.com/t5/Getting-Data-In/Why-License-Usage-has-empty-fields/m-p/626384#M107608 verbal_666 2023-01-10T06:48:52Z