Concerns I found the DMC tool (predecessor to MC) already present on scattered nodes in our environment. 1. How do I migrate from DMC tool to MC tool? Do I remove the existing DMC on nodes where found? There is no fundamental difference between DMC and MC, only a slightly more accurate feature name. I've updated the Splexicon with information that I hope makes this a little clearer: http://docs.splunk.com/Splexicon:Monitoringconsole As far as seeing the tool on every node in your deployment -- yes, DMC/MC comes with Enterprise and by default is unconfigured and can see some information about its local instance (as described here: http://docs.splunk.com/Documentation/Splunk/6.6.0/DMC/WhatcanDMCdo). To centrally monitor your entire deployment, follow the multi-instance deployment setup steps. Does MC actually run on V6.4.1 splunk enterprise or do I need to upgrade to 6.5 and above? 6.4.1 is fine. Upgrading to 6.5+ gets you the health check. Upgrading to 6.6+ gets you the data quality dashboard. As always, check the release notes for each version to learn about new features. ... View more

During a violation, searches to the _internal index still work, so you should be able to still troubleshoot licensing volume: http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Aboutlicenseviolations#What_happens_during_a_license_violation.3F ... View more

Upgrade first, then install the new license key: http://docs.splunk.com/Documentation/Splunk/6.5.1/Installation/HowtoupgradeSplunk#Get_and_install_the_new_.22no-enforcement.22_license The new license type is not recognized on pre-6.5.0 Enterprise versions. ... View more

http://docs.splunk.com/Documentation/Splunk/6.4.3/DMC/Deploymentsetupsteps for a distributed deployment (for example if you have separate indexers and search heads) or http://docs.splunk.com/Documentation/Splunk/6.4.3/DMC/Singleinstancesetup if you're using only one Splunk instance for everything. An Enterprise Trial license has all the same features as Enterprise, with a 500 MB/day indexing limit. (Internal log files do not count toward that quota.) ... View more

Hm, did you already find this detail in the REST API Reference Manual? It lists the possible values of status. http://docs.splunk.com/Documentation/Splunk/6.4.2/RESTREF/RESTdeploy#search.2Fdistributed.2Fpeers ... View more

Can you find it through Distributed Management Console > Indexing > License Usage? ... View more

Check out Search Usage Statistics and the Overview. ... View more

What information are you looking for? It looks like your DMC is in standalone mode. If you have a multi-instance deployment, you can set it up like MuS did to view data from all instances in your deployment. Here's what you need to do for that: http://docs.splunk.com/Documentation/Splunk/6.4.1/DMC/Deploymentsetupsteps ... View more

Which information in particular are you looking for? The docs have a super abbreviated sampling of information you can find in DMC dashboards: http://docs.splunk.com/Documentation/Splunk/6.4.0/DMC/WhatcanDMCdo ... View more

See this docs topic about using props and transforms to route and filter data (it's also linked from that licensing topic you pasted): http://docs.splunk.com/Documentation/Splunk/6.3.1/Forwarding/Routeandfilterdatad ... View more

Oh, you're right. "Use of the instance should be limited to DMC and these specific functions." I'll clarify that further down. Sounds like the recommendations are for you to provision a new instance for DMC (and you could probably also put the license master functions on that new instance). ... View more

I think Splunk03 meets these requirements from the docs topic ChrisG linked: "In a non-indexer-cluster environment, option 1: On the license master You can configure the monitoring console on your license master if the following are true: Your license master can handle the search workload, that is, meets or exceeds the search head reference hardware requirements. See "Reference hardware" in the Capacity Planning Manual. Only Splunk Enterprise admins can access your dedicated license master." ... View more

Like the docs you've pointed out say, the KV store captain handles writes to the KV store. The search head cluster doesn't care which of its nodes is doing what with KV store. KV store should work out of the box. Here's the small section on docs.splunk.com that outlines using KV store, with links to the docs on dev.splunk.com, where more of the usage docs live: http://docs.splunk.com/Documentation/Splunk/6.2.4/Admin/AboutKVstore#Use_the_KV_store ... View more

I don't know of one, but that doesn't mean it doesn't exist. Why do you want to do this? Here are the docs for the KV store endpoints: http://docs.splunk.com/Documentation/Splunk/6.2.4/RESTREF/RESTkvstore I don't see one in there for this purpose. ... View more

The KV store and search head clustering operate pretty much independently. The KV store captain is elected by its peers, just like the search head captain, although it is different code that runs those two elections. It's possible that one node would end up hosting both captains, but not necessary. The potential warning you point out is not a warning, but rather information about how kv store handles reads and writes. And where exactly do you think the docs are in conflict? KV store runs on a search head cluster, but search head clustering doesn't interact with the KV store. ... View more

Starting in version 6.2, Splunk Enterprise ships with a few preconfigured alerts (including one for license usage) that you can enable in the distributed management console. Read about Platform alerts in the Admin Manual. ... View more

This docs topic talks about calculating storage: http://docs.splunk.com/Documentation/Splunk/latest/Installation/Estimateyourstoragerequirements ... View more

I am curious about Updog. I wish someone would tell me about this Updog and what it is. ... View more

This sounds like you are using the PDF Report Server App, and it might be this problem: http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/PDFTS#I_am_receiving_emails_for_scheduled_searches.2Fdashboards_with_a_PDF_error_message ... View more

Which version of Splunk are you using? Does your dashboard have any advanced XML? Splunk's integrated PDF generation can't print advanced XML: http://docs.splunk.com/Documentation/Splunk/latest/Report/GeneratePDFsofyourreportsanddashboards#Exceptions ... View more

If you're using Splunk 6.0, or 5.x with the Splunk On Splunk App, you can check out the searches in the License Usage Report View (http://docs.splunk.com/Documentation/Splunk/latest/Admin/AboutSplunksLicenseUsageReportView ). You can view the search powering each panel in the report, and then copy and modify the search for your needs. All of the panels in the "Today" tab query the Splunk REST API. ... View more

Here are the new Splunk Cloud docs: http://docs.splunk.com/Documentation/SplunkCloud/latest/User/WhatisSplunkCloud Please do submit feedback for things that are unclear! ... View more

Be careful, the app is hard to configure and keep working. (I was not recommending it, just trying to narrow down where the problem was coming from.) And advances in SimpleXML in Splunk 6 give more functionality to the integrated PDF generation. You still need the app if you want to print Flash or advanced XML, but you should probably be weeding those out of your dashboards anyway. ... View more