Monitoring Splunk

License usage data missing from splunk

ppanchal
Path Finder

License usage data is missing from splunk.

index=_internal source=license_usage.log

Once the master is restarted the data starts indexing for this source and will index the data for few hours and then again it will stop.

Can someone please assist?

Tags (1)
0 Karma

horsefez
Motivator

Hi,

if your license master is indexing his _internal-data locally (which is not the best practice approach) it could happen that your instance stops indexing after reaching a minimum of 5GB disk space on your partition. (splunk-default).

Another option could be, that my source value for the usage.log looks like this
source=/opt/splunk/var/log/splunk/license_usage.log
Your query should be looking like this source=*license_usage.log

Additionally there could be a problem with Splunk writting the logfiles, but this could only be determined if there are any warnings or errors under splunkd.log.

0 Karma

ppanchal
Path Finder

How to prevent the index from stopping to index after reaching a min of 5GB?

0 Karma

mattymo
Splunk Employee
Splunk Employee

Stop using your license master as an indexer!!

Like pyro_wood advised, you should forward your License Master Logs (and any other Splunk instance that isn't an indexer) to your indexers!!

You can do this by going to settings > Forwarding & Receiving > Configuring Forwarding, or by using outputs.conf

https://docs.splunk.com/Documentation/Forwarder/6.6.0/Forwarder/Configureforwardingwithoutputs.conf

- MattyMo
0 Karma

horsefez
Motivator
0 Karma

adonio
Ultra Champion

very broad question, so any other info you can provide might help resolve faster
try and search:

  index=_internal source=*license_usage.log*

you will notice you need the wild card as this logs rotates and naming changes to:
license_usage.log.1
license_usage.log.2
.
.
.
license_usage.log.n
hope it helps

0 Karma

ppanchal
Path Finder

This did not help, tried it.

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...