How can I identify an indexer using my license master?

[a212830]

A rogue splunk installation within our corp network is using our license master. Unfortunately, there is no information that I see in the LM interface nor logs that can tell me the IP or hostname of the server. I can only get the GUID and the splunk instance name.

Is there a way to get the IP of a connecting license slave?

[sloshburch]

That's totally normal!

The indexers will hold onto license consumption details until they reconnect to the license server. The license server then records that info for the day it learns about it - not when the data was actually indexed. As a result, the license usage for the day the license server is turned back on is likely going to be equivalent to the license usage for that day plus the days it was offline that the indexers couldn't communicate.

Regardless, after that first day, the license server should show normal usage for the days after. Does that correspond with what you're seeing?