License usage data missing from splunk

[ppanchal]

License usage data is missing from splunk.

index=_internal source=license_usage.log

Once the master is restarted the data starts indexing for this source and will index the data for few hours and then again it will stop.

Can someone please assist?

[horsefez]

Hi,

if your license master is indexing his _internal-data locally (which is not the best practice approach) it could happen that your instance stops indexing after reaching a minimum of 5GB disk space on your partition. (splunk-default).

Another option could be, that my source value for the usage.log looks like this
source=/opt/splunk/var/log/splunk/license_usage.log
Your query should be looking like this source=*license_usage.log

Additionally there could be a problem with Splunk writting the logfiles, but this could only be determined if there are any warnings or errors under splunkd.log.

[ppanchal]

How to prevent the index from stopping to index after reaching a min of 5GB?

[mattymo]

Stop using your license master as an indexer!!

Like pyro_wood advised, you should forward your License Master Logs (and any other Splunk instance that isn't an indexer) to your indexers!!

You can do this by going to settings > Forwarding & Receiving > Configuring Forwarding, or by using outputs.conf

https://docs.splunk.com/Documentation/Forwarder/6.6.0/Forwarder/Configureforwardingwithoutputs.conf

[horsefez]

Hi,

lower the limit:
http://docs.splunk.com/Documentation/Splunk/6.6.1/Admin/Changedefaultvalues#Set_minimum_free_disk_sp...

[adonio]

very broad question, so any other info you can provide might help resolve faster
try and search:

  index=_internal source=*license_usage.log*

you will notice you need the wild card as this logs rotates and naming changes to:
license_usage.log.1
license_usage.log.2
.
.
.
license_usage.log.n
hope it helps

[ppanchal]

This did not help, tried it.