Awesome, that was exactly it. Now I have data in the License Usage app for the first time. This makes it drastically easier to evaluate Splunk for larger deployments. Thanks very much! ... View more

ok, thanks. I didn't realize I was looking at a troubleshooting situation, I thought I just missed some configuration that needed to be set and perhaps it was a common issue since otherwise my setup is all defaults. According to Manager » Forwarding and receiving » Forward data it says there are "There are no configurations of this type" so I didn't think it was forwarding all the data somewhere else. Apparently I'm significantly misunderstanding that and will consider opening a support ticket. ... View more

according to manager>>indexes it's located at /opt/splunk/var/lib/splunk/_internaldb/db However, it is size 0 with 0 events. Is there something that needs to be configured or enabled to populate this index? ... View more

btw, should that search return anything in Splunk itself? It returns "No results found" when I use it from the search bar. ... View more

No, I am on OpenSuse 11.2 running a single Splunk instance and am not using Splunk on any windows machines at all. My data sources are the local host and a few remote syslogs feeding to directly Splunk on port 514. Splunk itself seems to be working well, I'm just looking for details to determine the data size of various sources so that I can make intelligent choices about cost/benefit for specific event types. Other posts I've read here imply that this app does exactly that, but so far it hasn't returned any info at all. ... View more