topic Re: License usage data missing from splunk in Monitoring Splunk

License usage data missing from splunk

ppanchal — Tue, 29 Sep 2020 14:38:50 GMT

License usage data is missing from splunk.

index=_internal source=license_usage.log

Once the master is restarted the data starts indexing for this source and will index the data for few hours and then again it will stop.

Can someone please assist?

Re: License usage data missing from splunk

adonio — Tue, 29 Sep 2020 14:34:29 GMT

very broad question, so any other info you can provide might help resolve faster
try and search:

  index=_internal source=*license_usage.log*

you will notice you need the wild card as this logs rotates and naming changes to:
license_usage.log.1
license_usage.log.2
.
.
.
license_usage.log.n
hope it helps

Re: License usage data missing from splunk

horsefez — Fri, 23 Jun 2017 16:45:06 GMT

Hi,

if your license master is indexing his _internal-data locally (which is not the best practice approach) it could happen that your instance stops indexing after reaching a minimum of 5GB disk space on your partition. (splunk-default).

Another option could be, that my source value for the usage.log looks like this
source=/opt/splunk/var/log/splunk/license_usage.log
Your query should be looking like this source=*license_usage.log

Additionally there could be a problem with Splunk writting the logfiles, but this could only be determined if there are any warnings or errors under splunkd.log.

Re: License usage data missing from splunk

ppanchal — Fri, 23 Jun 2017 16:54:59 GMT

How to prevent the index from stopping to index after reaching a min of 5GB?

Re: License usage data missing from splunk

ppanchal — Fri, 23 Jun 2017 16:56:44 GMT

This did not help, tried it.

Re: License usage data missing from splunk

horsefez — Fri, 23 Jun 2017 17:00:41 GMT

Hi,

lower the limit:
http://docs.splunk.com/Documentation/Splunk/6.6.1/Admin/Changedefaultvalues#Set_minimum_free_disk_space

Re: License usage data missing from splunk

mattymo — Sun, 25 Jun 2017 11:36:51 GMT

Stop using your license master as an indexer!!

Like pyro_wood advised, you should forward your License Master Logs (and any other Splunk instance that isn't an indexer) to your indexers!!

You can do this by going to settings > Forwarding & Receiving > Configuring Forwarding, or by using outputs.conf

https://docs.splunk.com/Documentation/Forwarder/6.6.0/Forwarder/Configureforwardingwithoutputs.conf