https://community.splunk.com/t5/Splunk-Search/Why-is-index-internal-source-license-usage-log-returning-no-data/m-p/296025#M163704 <P>Ahhh, it sounds like your license master isn't forwarding its logs to your indexers. This would definitely result in what you are seeing.</P> <P>I highly recommend putting that forwarding in place. If you run this on your license master you'll likely see no forwarders defined:</P> <PRE><CODE>splunk list forward-server </CODE></PRE> Thu, 11 Jan 2018 22:16:57 GMT micahkemp 2018-01-11T22:16:57Z https://community.splunk.com/t5/Splunk-Search/Why-is-index-internal-source-license-usage-log-returning-no-data/m-p/296022#M163701 <P>Running this search from a search head (also tried the indexer) and attempting to breakdown the daily license usage for a particular index over a 1 week period. Seemed easy enough. But getting (0) records returned for even a basic query of usage data. Appears that I'm not tracking licensing usage? Whaaaaat?</P> <P>Primary Search (using "oracle" index):<BR /> index=_internal source=<EM>license_usage.log</EM> type="Usage" splunk_server=* idx=oracle earliest=-1w@d <BR /> | eval Date=strftime(_time, "%Y/%m/%d") <BR /> | eventstats sum(b) as volume by st, Date <BR /> | eval MB=round(volume/1024/1024,5)<BR /> | timechart first(MB) AS volume by st</P> <P>Tested for license usage data (got zero records returned as well???):<BR /> index=_internal source=*license_usage.log</P> <P>I'm the splunk admin, checked that the admin role has access to all internal indexes &amp; all non-internal indexes. Super strange. Helpful ideas???</P> <P>Thanks in advance!</P> <P>Joe</P> Tue, 29 Sep 2020 17:33:40 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-index-internal-source-license-usage-log-returning-no-data/m-p/296022#M163701 joesrepsol 2020-09-29T17:33:40Z https://community.splunk.com/t5/Splunk-Search/Why-is-index-internal-source-license-usage-log-returning-no-data/m-p/296023#M163702 <P>Your source isn't <CODE>license_usage.log</CODE>, but it can be matched with <CODE>*license_usage.log</CODE>:</P> <PRE><CODE>index=_internal source=*license_usage.log type="Usage" splunk_server=* idx=oracle earliest=-1w@d | eval Date=strftime(_time, "%Y/%m/%d") | eventstats sum(b) as volume by st, Date | eval MB=round(volume/1024/1024,5) | timechart first(MB) AS volume by st </CODE></PRE> <P>This worked for me, removing the splunk_server, idx filters:</P> <PRE><CODE>index=_internal source=*license_usage.log type="Usage" | eval Date=strftime(_time, "%Y/%m/%d") | eventstats sum(b) as volume by st, Date | eval MB=round(volume/1024/1024,5) | timechart first(MB) AS volume by st </CODE></PRE> Thu, 11 Jan 2018 22:09:48 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-index-internal-source-license-usage-log-returning-no-data/m-p/296023#M163702 micahkemp 2018-01-11T22:09:48Z https://community.splunk.com/t5/Splunk-Search/Why-is-index-internal-source-license-usage-log-returning-no-data/m-p/296024#M163703 <P>I do have the star license_usage.log star in my query... for some reason the web GUI marks that as italics... and it didn't show up on the webpage.</P> <P>It does work on my license master though... so when using a license master, is all the licensing information only available on that master?</P> Thu, 11 Jan 2018 22:14:12 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-index-internal-source-license-usage-log-returning-no-data/m-p/296024#M163703 joesrepsol 2018-01-11T22:14:12Z https://community.splunk.com/t5/Splunk-Search/Why-is-index-internal-source-license-usage-log-returning-no-data/m-p/296025#M163704 <P>Ahhh, it sounds like your license master isn't forwarding its logs to your indexers. This would definitely result in what you are seeing.</P> <P>I highly recommend putting that forwarding in place. If you run this on your license master you'll likely see no forwarders defined:</P> <PRE><CODE>splunk list forward-server </CODE></PRE> Thu, 11 Jan 2018 22:16:57 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-index-internal-source-license-usage-log-returning-no-data/m-p/296025#M163704 micahkemp 2018-01-11T22:16:57Z https://community.splunk.com/t5/Splunk-Search/Why-is-index-internal-source-license-usage-log-returning-no-data/m-p/296026#M163705 <P>It only shows one active forwards. It's one of my indexers. There is another listed as "configured but inactive forwards"... and it's the other indexer (part of a 2 Indexer cluster).</P> <P>So how would I configure this to forward and whats the impact? Does it just forward the licensing_usage log? or all of the _internal? Reading up on this feature.</P> <P>We have (3) splunk environments... DEV, PROD, and a PCI space. All 3 report up to the same license master and we separate the pools there. Wondering if that's an optimal configuration?</P> <P>Thanks for the help!</P> <P>Joe</P> Thu, 11 Jan 2018 22:22:59 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-index-internal-source-license-usage-log-returning-no-data/m-p/296026#M163705 joesrepsol 2018-01-11T22:22:59Z https://community.splunk.com/t5/Splunk-Search/Why-is-index-internal-source-license-usage-log-returning-no-data/m-p/296027#M163706 <P>hey @joesrepsol</P> <P>Is your license master forwarding internal logs to indexers?<BR /> If you are not then have a look at this doc!<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.0.1/Indexer/Forwardmasterdata">https://docs.splunk.com/Documentation/Splunk/7.0.1/Indexer/Forwardmasterdata</A></P> Fri, 12 Jan 2018 05:27:28 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-index-internal-source-license-usage-log-returning-no-data/m-p/296027#M163706 mayurr98 2018-01-12T05:27:28Z https://community.splunk.com/t5/Splunk-Search/Why-is-index-internal-source-license-usage-log-returning-no-data/m-p/296028#M163707 <P>Can confirm. Had a similar issue when I replaced an indexer.</P> <P>Created an outputs.conf file that pointed to my indexer and restarted Splunk. All works well now.</P> Thu, 21 Feb 2019 14:47:28 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-index-internal-source-license-usage-log-returning-no-data/m-p/296028#M163707 DBattisto 2019-02-21T14:47:28Z