I have a license server where I have two indexer pools A and B configured. Pool A consists of a cluster of 5 indexers and an average consumption of 500GB. Pool B consists of 1 indexer and a consumption of 100GB per day. In pool B, data from an F5 index is forwarded to the indexer in pool A. My license consumption has increased to over 800GB total consumption. My question is: Is forwarding data from indexer B to indexer A causing me to consume more license? Would it help if I change the configuration to a single pool?   ... View more

Hello community. We have a cluster architecture with 5 indexes. We have detected high license consumption, we are trying to identify the sources that generate it. I am using the following search to find out which Windows index host consumes the most license: index=_internal type="Usage" idx=wineventlog | eval MB=round(b/1024/1024, 2) | stats sum(MB) as "Consumo de Licencia (MB)" by h | rename h as "Host" | sort -"Consumo de Licencia (MB)" With this search I can see the hosts and the consumption in megabytes, but in the h field, there are no values ​​or hosts, which I cannot identify and I need to know which are those hosts, since the sum of all of them gives me a high license consumption. What could be the cause of that?     this is the events from uknowns_host: I cannot identify what they are, if they are a specific host, if it is a Splunk component, or something that is causing this license increase. Regards   ... View more

Hello everyone. I have set up a cluster of 3 search heads, I have the Serach Head 1 configured as captain, but it turns out that there are times that I do not see events in that same SH1 and SH2, this causes alerts that I have configured in my SH1 to activate, since they do not events are displayed on the SH1. What I have to do is change how SH3 is populated and the display of events is restored, temporarily solving the problem. After a while I find out that SH1 takes the role of captain again and again I can't view events on SH1. Why could it be happening? Regards.   ... View more

I have a device that is reporting to the splunk through syslog, that device first goes through an F5 and the F5 gives me the traffic to my heavy forwarders. The problem is that the year of the time stamp is out of date, the date when a server event is generated is 2022 and in the search head, I see it as 2017. I don't know if the problem is from the origin server at the syslog protocol level or in the transport layer or at the collection level within the splunk. This issue only occurs on 3 computers out of 10. I have reviewed the prop settings, but if I don't see the year in the source data, I will hardly be able to modify the timestamp. Regards     ... View more