We have an Index Cluster with two servers and have the same issue in the monitoring console. The "/opt/splunk/var/log/splunk/license_usage.log" is synced between both indexers. It counts the bytes twice , so we always see double the usage size when split by index. Now, instead, we use the Usage Report on the license master (en-GB/manager/search/licenseusage) where it works. Try to find a rare byte value in your logs from the search below. You should see the log coming in from all your Splunk Servers. `dmc_set_index_internal` source=*license_usage.log* type="Usage" Enter the rare byte value. `dmc_set_index_internal` source=*license_usage.log* type="Usage" <Rare Byte Value>
... View more