Splunk Enterprise

Am I sending License data from the indexer to the SH, and then the same data is being sent back to the Indexers?

robertlynch2020
Motivator

Hi

I have configured a 3INX 1SH 1MN cluster.

I have activated the license master on the SH, I have noticed that the "index=_internal source=*license_usage.log" Is only available on the SH, meaning the data from the indexes are being sent from the indexers to the SH.

I am reading this document about how we should send all _internal data to the Indexers?

https://docs.splunk.com/Documentation/Splunk/7.0.1/Indexer/Forwardmasterdata?_ga=2.199674158.1222254...

So, when I activated this, am I not sending back the same data that the indexers have just sent me?

Or does something happen where the data is not sent at all?

Thanks in advance

Rob 

Labels (2)
0 Karma
1 Solution

robertlynch2020
Motivator
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's not the same data.  The indexers are sending usage information to the LM (SH).  The LM is then saves that usage (in a different format) in a log file that is written to the indexers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

robertlynch2020
Motivator

ok - thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...