Am I sending License data from the indexer to the SH, and then the same data is being sent back to the Indexers?

[robertlynch2020]

Hi

I have configured a 3INX 1SH 1MN cluster.

I have activated the license master on the SH, I have noticed that the "index=_internal source=*license_usage.log" Is only available on the SH, meaning the data from the indexes are being sent from the indexers to the SH.

I am reading this document about how we should send all _internal data to the Indexers?

https://docs.splunk.com/Documentation/Splunk/7.0.1/Indexer/Forwardmasterdata?_ga=2.199674158.1222254...

So, when I activated this, am I not sending back the same data that the indexers have just sent me?

Or does something happen where the data is not sent at all?

Thanks in advance

Rob 

[richgalloway]

It's not the same data.  The indexers are sending usage information to the LM (SH).  The LM is then saves that usage (in a different format) in a log file that is written to the indexers.

[robertlynch2020 · Accepted solution]

ok - thanks