https://community.splunk.com/t5/Getting-Data-In/Why-does-our-License-Report-show-an-increase-for-a-quot-default/m-p/210018#M41377 <P>From your License Master check out:</P> <PRE><CODE> index=_internal source=*license_usage.log type="Usage" idx=default </CODE></PRE> <P>This resulted in some logs which helped us identify the offending systems/hosts as show in the modified logs below:</P> <PRE><CODE>11-18-2015 19:52:57.182 +0000 INFO LicenseUsage - type=Usage s="/var/log/windows/123.123.123.123/syslog.log" st="syslog-141" h="the_host_name" o="" idx="default" i="85293027-217B-40FF-8D1E-D9177AFECEB1" pool="auto_generated_pool_enterprise" b=402 poolsz=53687091200 </CODE></PRE> <P>We logged into the_host_name syslog box and saw that a few of the stanzas in the inputs.conf file did not have an index specified, so we added our default index (which is main)</P> <PRE><CODE>[monitor:///var/log] disabled = false followTail = 1 sourcetype = syslog whitelist = .log$ index = main </CODE></PRE> <P>After this fix, we've had no further logging to index=default. Why this suddenly started to happen after the upgrade to 6.3... no idea.</P> Tue, 29 Sep 2020 07:56:10 GMT ejharts2015 2020-09-29T07:56:10Z https://community.splunk.com/t5/Getting-Data-In/Why-does-our-License-Report-show-an-increase-for-a-quot-default/m-p/210017#M41376 <P>I recently upgraded Splunk to 6.3. Our environment has 1 search head, 2 indexers and 1 deployment/licensing server all on Windows.</P> <P>When reviewing my license usage by index, I saw that starting on the day we did the upgrade, there is a new entry for a "default" index which is taking up ~10GB a day. When I try to dig into what is causing this and search <CODE>index=default</CODE>, there is a warning on search that "Search uses index=default this setting has been deprecated".</P> <P>How can I dig in and determine what is causing this license utilization? Is there any what to see what is making up the data assigned to the "default" index?</P> Fri, 30 Oct 2015 14:08:10 GMT https://community.splunk.com/t5/Getting-Data-In/Why-does-our-License-Report-show-an-increase-for-a-quot-default/m-p/210017#M41376 stevepraz 2015-10-30T14:08:10Z https://community.splunk.com/t5/Getting-Data-In/Why-does-our-License-Report-show-an-increase-for-a-quot-default/m-p/210018#M41377 <P>From your License Master check out:</P> <PRE><CODE> index=_internal source=*license_usage.log type="Usage" idx=default </CODE></PRE> <P>This resulted in some logs which helped us identify the offending systems/hosts as show in the modified logs below:</P> <PRE><CODE>11-18-2015 19:52:57.182 +0000 INFO LicenseUsage - type=Usage s="/var/log/windows/123.123.123.123/syslog.log" st="syslog-141" h="the_host_name" o="" idx="default" i="85293027-217B-40FF-8D1E-D9177AFECEB1" pool="auto_generated_pool_enterprise" b=402 poolsz=53687091200 </CODE></PRE> <P>We logged into the_host_name syslog box and saw that a few of the stanzas in the inputs.conf file did not have an index specified, so we added our default index (which is main)</P> <PRE><CODE>[monitor:///var/log] disabled = false followTail = 1 sourcetype = syslog whitelist = .log$ index = main </CODE></PRE> <P>After this fix, we've had no further logging to index=default. Why this suddenly started to happen after the upgrade to 6.3... no idea.</P> Tue, 29 Sep 2020 07:56:10 GMT https://community.splunk.com/t5/Getting-Data-In/Why-does-our-License-Report-show-an-increase-for-a-quot-default/m-p/210018#M41377 ejharts2015 2020-09-29T07:56:10Z