Hey @SGun ,  how did you end up implementing it?  Thanks!  ... View more

Hey @Dilsheer_P ,  did you find a way that worked for you?  Thanks! ... View more

A restart of the SHC resolved the issue  ... View more

Hey Guiseppe,  Thanks for replying. Yeah we did not have delayed searches in the last 24h.  One day later we still have exactly the same numbers.     ... View more

Not sure if this is exactly the same topic, but here is a good explanation about how to abuse Terminal Emulators with ANSI Escape Characters.  https://www.cyberark.com/resources/threat-research-blog/dont-trust-this-title-abusing-terminal-emulators-with-ansi-escape-characters ... View more

Any updates?  ... View more

Hi,  1. It is a response to the question above.  2. Maybe we have a configuration issue then, and @alexanderl might has the same. But that is not exactly the point. I just wanted to add some help on the discussion to "Anybody has a clue as to why?". In our case this is the problem.`dmc_licensing_usage_all()' just adds up those number and returns double the actual license usage.          ... View more

We have an Index Cluster with two servers and have the same issue in the monitoring console.  The "/opt/splunk/var/log/splunk/license_usage.log" is synced between both indexers. It counts the bytes twice , so we always see double the usage size when split by index.  Now, instead, we use the Usage Report on the license master (en-GB/manager/search/licenseusage) where it works.  Try to find a rare byte value in your logs from the search below. You should see the log coming in from all your Splunk Servers.   `dmc_set_index_internal` source=*license_usage.log* type="Usage"   Enter the rare byte value.   `dmc_set_index_internal` source=*license_usage.log* type="Usage" <Rare Byte Value>     ... View more