Question about license usage on license slave

[araitz]

A customer was using the Splunk Deployment Monitor app that ships with Splunk to monitor license usage, most often by sourcetype.

After making the Splunk instances being monitored license slaves of a license master, they were no longer able to view their license usage in the Deployment Monitor app.

In investigating, it seems that $SPLUNK_HOME/var/log/splunk/license_usage.log is no longer being written to on the license slaves.

How can they search on license usage again?

[Genti · Accepted solution]

Once you turn your indexers into slaves, they do not write their information on license_usage.log locally.
This information is all written to license_usage.log on the license master.

In order to get visibility into this again you need to do one of the following:

1. install deployment monitor on your license master

2. just add the license master as a peer (via distributed search) to the box that is currently hosting the deployment monitor app.

Either of the two should work, however, the second is somewhat simpler.

Cheers!

.gz