Overview of Issue I've seen a few discussions on this topic, but none of them seem clear to me. We have two indexers configured as license slaves that report back to our license master. The license master runs on the same server as the Distributed Management Console. The indexers are also setup as search peers from the DMC console. I'm not sure why I would want to forward my DMC _internal events to the indexers when the indexers specifically state that they report licensing info back to the DMC. The default search returns no results: index=_internal host=lspldmc source=*license_usage.log type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | timechart span=1d sum(b) AS "volume" fixedrange=false | join type=outer _time [search index=_internal host=lspldmc source=*license_usage.log type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(stacksz) AS "stack size" by _time] | fields - _timediff | foreach * [eval <>=round('<>'/1024/1024/1024, 3)] Returns accurate license data index=_internal splunk_server=local source=*license_usage.log type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | timechart span=1d sum(b) AS "volume" fixedrange=false | join type=outer _time [search index=_internal host=lspldmc source=*license_usage.log type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(stacksz) AS "stack size" by _time] | fields - _timediff | foreach * [eval <>=round('<>'/1024/1024/1024, 3)] Troubleshooting Running the below search from the dmc returns the event below. index=_internal source=*license_usage.log 03-03-2016 19:08:01.766 -0600 INFO LicenseUsage - type=Message - License usage logging not available for slave licensing instances, please see license_usage.log on license master=https://lspldmc:8089 for usage breakdown The two hosts searched are my indexers. Links already researched: http://docs.splunk.com/Documentation/Splunk/latest/Admin/LicenseUsageReportViewexamples https://answers.splunk.com/answers/113466/license-usage-past-30-days-dont-work.html ... View more

We need to change the hostname and port that the "View results in Splunk" link auto populates. Where is the proper place to change this setting in the config files? ... View more

Is it best practice to copy the /search/local directory to the new search head cluster members and not use the deployer? I used a deployer to set up LDAP, but per documentation, it says not to do the same for the search application. Per Documentation: The types of updates that the deployer handles These are the specific types of updates that require the deployer: New or upgraded apps. Configuration files that you edit directly. All non-search-related updates, even those that can be configured through the CLI or Splunk Web, such as updates to indexes.conf or inputs.conf. Settings that need to be migrated from a search head pool or a standalone search head. These can be app or user settings. ... View more

What we are trying to do? Multiple Universal forwarders with different indexes forwarding data to a load balanced address. This load balanced address has two pool members (Heavy Forwarders). These Heavy Forwarders receive and forward the data onto the indexers/3rd party systems. These indexers are not clustered to save on storage and only certain indexes are hard configured to specific indexers. I realize we could use a replication factor of one. The question? How do the Heavy Forwarders know where to send indexes if specific indexes are only configure for specific indexers.? Diagram Universal Forwarder with index=test1 ------> splunktest.com (pool members: heavyforwarder1 && heavyforwarder2) Universal Forwarder with index=test2 ------> splunktest.com (pool members: heavyforwarder1 && heavyforwarder2) test1 is configured only on indexer1 && test2 is configured only on indexer2 What keeps the heavy forwarders from sending index=test1 data to indexer2? Do we just need to use indexer clustering after all? Thank You for your time ... View more