Splunk Enterprise

Am I sending License data from the indexer to the SH, and then the same data is being sent back to the Indexers?

robertlynch2020
Motivator

Hi

I have configured a 3INX 1SH 1MN cluster.

I have activated the license master on the SH, I have noticed that the "index=_internal source=*license_usage.log" Is only available on the SH, meaning the data from the indexes are being sent from the indexers to the SH.

I am reading this document about how we should send all _internal data to the Indexers?

https://docs.splunk.com/Documentation/Splunk/7.0.1/Indexer/Forwardmasterdata?_ga=2.199674158.1222254...

So, when I activated this, am I not sending back the same data that the indexers have just sent me?

Or does something happen where the data is not sent at all?

Thanks in advance

Rob 

Labels (2)
0 Karma
1 Solution

robertlynch2020
Motivator
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's not the same data.  The indexers are sending usage information to the LM (SH).  The LM is then saves that usage (in a different format) in a log file that is written to the indexers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

robertlynch2020
Motivator

ok - thanks

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...