Monitoring Splunk

Question about license usage on license slave

araitz
Splunk Employee
Splunk Employee

A customer was using the Splunk Deployment Monitor app that ships with Splunk to monitor license usage, most often by sourcetype.

After making the Splunk instances being monitored license slaves of a license master, they were no longer able to view their license usage in the Deployment Monitor app.

In investigating, it seems that $SPLUNK_HOME/var/log/splunk/license_usage.log is no longer being written to on the license slaves.

How can they search on license usage again?

1 Solution

Genti
Splunk Employee
Splunk Employee

Once you turn your indexers into slaves, they do not write their information on license_usage.log locally.
This information is all written to license_usage.log on the license master.

In order to get visibility into this again you need to do one of the following:

1. install deployment monitor on your license master

2. just add the license master as a peer (via distributed search) to the box that is currently hosting the deployment monitor app.

Either of the two should work, however, the second is somewhat simpler.

Cheers!

.gz

View solution in original post

Genti
Splunk Employee
Splunk Employee

Once you turn your indexers into slaves, they do not write their information on license_usage.log locally.
This information is all written to license_usage.log on the license master.

In order to get visibility into this again you need to do one of the following:

1. install deployment monitor on your license master

2. just add the license master as a peer (via distributed search) to the box that is currently hosting the deployment monitor app.

Either of the two should work, however, the second is somewhat simpler.

Cheers!

.gz

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...