topic Re: Why are some keys in license_usage.log empty? in Getting Data In

Why are some keys in license_usage.log empty?

twinspop — Wed, 10 May 2017 19:54:51 GMT

I'm trying to use the license_usage.log as a way to track source(type) volume on a per index basis, something not really possible with METRICS logs. But I see sometimes the s and/or st and/or h fields are empty. Why is this? Samples:

05-10-2017 15:47:03.209 -0400 INFO  LicenseUsage - type=Usage s="/app/tomcatprofile/xxx/logs/some-services.log" st=sc_tomcat h=somehost o="" idx="smartconnect" i="GUID1" pool="Staging" b=145 poolsz=524288000000

05-10-2017 15:49:05.582 -0400 INFO  LicenseUsage - type=Usage s="" st=sc_tomcat h="" o="" idx="smartconnect" i="GUID2" pool="Staging" b=43643 poolsz=524288000000

EDIT: Is this related to the metrics tracking limits? The same mechanism in the background is providing this numbers, and so if a particular source, sourcetype, or host is not in the top 10 (or whatever you have your limits set to), you get an empty string?

Re: Why are some keys in license_usage.log empty?

twinspop — Wed, 10 May 2017 20:02:40 GMT

The sc_tomcat sourcetype has only one input defined. The first log shows it, the second leaves it out.

Re: Why are some keys in license_usage.log empty?

mdsnmss — Fri, 11 Aug 2017 18:49:13 GMT

This will periodically happen for host (h) or source (s) values. It is related to squashing of the values. A good answer of why this occurs is given here: https://answers.splunk.com/answers/48542/blank-h-and-s-in-license-usage-log.html