Monitoring Splunk

License usage data missing from splunk

ppanchal
Path Finder

License usage data is missing from splunk.

index=_internal source=license_usage.log

Once the master is restarted the data starts indexing for this source and will index the data for few hours and then again it will stop.

Can someone please assist?

Tags (1)
0 Karma

horsefez
Motivator

Hi,

if your license master is indexing his _internal-data locally (which is not the best practice approach) it could happen that your instance stops indexing after reaching a minimum of 5GB disk space on your partition. (splunk-default).

Another option could be, that my source value for the usage.log looks like this
source=/opt/splunk/var/log/splunk/license_usage.log
Your query should be looking like this source=*license_usage.log

Additionally there could be a problem with Splunk writting the logfiles, but this could only be determined if there are any warnings or errors under splunkd.log.

0 Karma

ppanchal
Path Finder

How to prevent the index from stopping to index after reaching a min of 5GB?

0 Karma

mattymo
Splunk Employee
Splunk Employee

Stop using your license master as an indexer!!

Like pyro_wood advised, you should forward your License Master Logs (and any other Splunk instance that isn't an indexer) to your indexers!!

You can do this by going to settings > Forwarding & Receiving > Configuring Forwarding, or by using outputs.conf

https://docs.splunk.com/Documentation/Forwarder/6.6.0/Forwarder/Configureforwardingwithoutputs.conf

- MattyMo
0 Karma

horsefez
Motivator
0 Karma

adonio
Ultra Champion

very broad question, so any other info you can provide might help resolve faster
try and search:

  index=_internal source=*license_usage.log*

you will notice you need the wild card as this logs rotates and naming changes to:
license_usage.log.1
license_usage.log.2
.
.
.
license_usage.log.n
hope it helps

0 Karma

ppanchal
Path Finder

This did not help, tried it.

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...