Splunk _internal logs consuming license?

New Member

Hi Team,

I have 5 GB enterprise license.We have created 8 indexes in splunk. From few days there were no data observed on created indexes,
but still license has been used and we met license violation.
I am not able to find any data on search head. Does that mean the _internal logs consuming license.?
Anyone faced this issue?
Please suggest a solutions?

Thnaks & Regards,

Tags (1)
0 Karma


All internal indexes (internal and all other index names starting with '') do not count against your license. If you have a license violation then you must have ingested more than 5GB into your indexes. Use the Monitoring Console to run License Usage and Index Detail reports. They should help identify the source of the violation.

If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!