There is no automatic failover for the SHC Deployer.  If a customer wants a backup deployer then it's up to them to keep the backup in sync with the primary.  Make sure the customer is aware that a SHC will function normally without a deployer.  The deployer is only needed to install/update apps. ... View more

I've had this same issue. I was able to resolve it by ensuring that my Deployment Server is set to a "search head" along with being a deployment server. Are you receiving other _internal logs from your deployment server? Run this query on your search head: index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | timechart span=1d sum(b) AS "volume" fixedrange=false | join type=outer _time [search index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(stacksz) AS "stack size" by _time] | fields - _timediff | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] If this search works then that means your Deployment Server is not configured to search within it's own logs.  ... View more

Yes, that's the sort of thing, however, be careful that the search returns some rows otherwise the whole index gets deleted. You can do this something like this index=_internal earliest=+1d latest=+15y | appendpipe [stats count as events | where events = 0 | eval gobbledygook = random()] | delete ... View more