License_usage.log: How to find what system/host is sending certain log entries and if these count against my license?

[hartfoml]

I have this log entry in the "license_usage.log" file

10-20-2014 23:56:16.888 -0500 INFO LicenseUsage - type=Usage s="" st="WinEventLog:Application" h="" o="" i="27AA4E28-C9C6-4177-84F1-9A79462121BB" pool="auto_generated_pool_enterprise" b=55412 poolsz=xxxxxxxxxxxx

I don't know what system is sending these logs. How do I know what system is sending these logs and if I am being charged for the logs from this system?

[chanfoli]

One thing I thought of is using netstat on your indexer(s) to identify IPs of all TCP connections to 9997 and work through the IPs. Another is to search your index(es) for events with anomalous host fields for sourcetype="WinEventLog:Application"

[chanfoli]

This may also be relevant to your case: http://answers.splunk.com/answers/48542/blank-h-and-s-in-license-usage-log.html