(A customer has an environment with a Search Head Cluster and an indexer cluster. They are troubleshooting license usage data, including indexed volume in bytes per pool, index, host, sourcetype…

Question

Options

• ACluster Manager and Search Head Cluster Deployer
• BLicense Manager
• CSearch Head Cluster Deployer only
• DAll indexers

• B
  94% (33)
• C
  3% (1)
• D
  3% (1)

Explanation

The license_usage.log file is generated and maintained on the License Manager node in a Splunk deployment. This log provides detailed statistics about daily license consumption, including data volume indexed per pool, index, sourcetype, source, and host. In a distributed or clustered environment (with both search head and indexer clusters), the License Manager acts as the central authority that collects license usage information from all indexers and consolidates it into this log. The License Manager receives periodic reports from each license peer (indexer) and records them in: $SPLUNK_HOME/var/log/splunk/license_usage.log The log is automatically indexed into the _internal index with sourcetype=splunkd and can be queried using searches such as: index=_internal source=license_usage.log type="RolloverSummary" Other components like the Cluster Manager, SHC Deployer, or individual indexers do not store the full consolidated license usage data - they only send summarized reports to the License Manager. Therefore, the License Manager is the definitive and Splunk-documented location for retrieving and analyzing license_usage.log data across a distributed deployment. - Managing Licenses in a Distributed Environment - license_usage.log Reference and Structure - Monitoring License Consumption Using the License Manager - Splunk Enterprise Admin Manual - License Reporting and Troubleshooting

No community discussion yet for this question.