The license_usage.log on my license master indicates usage for the sourcetype MSExchange:2013:MailboxAudit but no events are returned in searches.
I've run the above searches using all time real time to rule out time discrepancies and license usage with no events for that time period are still present. My role has privileges to view this data.
This question appears to be a very similar situation. I am unable to simply disable this input to resolve this. Can anyone explain what is going on?
