Installation

License_usage.log: How to find what system/host is sending certain log entries and if these count against my license?

hartfoml
Motivator

I have this log entry in the "license_usage.log" file

10-20-2014 23:56:16.888 -0500 INFO LicenseUsage - type=Usage s="" st="WinEventLog:Application" h="" o="" i="27AA4E28-C9C6-4177-84F1-9A79462121BB" pool="auto_generated_pool_enterprise" b=55412 poolsz=xxxxxxxxxxxx

I don't know what system is sending these logs. How do I know what system is sending these logs and if I am being charged for the logs from this system?

Labels (1)
0 Karma

chanfoli
Builder

One thing I thought of is using netstat on your indexer(s) to identify IPs of all TCP connections to 9997 and work through the IPs. Another is to search your index(es) for events with anomalous host fields for sourcetype="WinEventLog:Application"

0 Karma

chanfoli
Builder
0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...