Hi everyone, I am currently investigating a sudden Splunk license usage spike. When looking at my license metrics using SPL: index="_internal" source="*license_usage.log" type=Usage | stats sum(b) as bytes by h, s, st | eval gb = round(bytes/1024/1024/1024, 2) | rename h as host, s as source, st as sourcetype | sort - gb I noticed a row where the host field is, one of the host is blank/empty, but it is consuming over 100 GB of license data per day. I read a community post mentioning: "The reason for blank host (field 'h') or sourcetype (st)/source(s) is due to squashing in license logs." Questions for the community: 1. Is it normal for a squashed entry to represent such a massive volume (100+ GB)? 2. If the License Manager has squashed the host field to conserve memory, what is the best strategy or alternative SPL query to find out which actual backend host(s) are sending this specific data? ... View more