We have a few diffent splunk splunk installations which i would like all to use a central License master.
However if a different team mananges the other splunk installation and i have setup a pool and licence allocation for them - how can they see and monitor their usage?
I dont want to permission them to the License Manager Search head.
As i understand no license usage is logged to the slaves?
Do i have to create a report to send out license usage details to respective team?
Or is there a way to get this data to the slave installation?
I have the exact same issue at at customers site, and will have to solve this using a variant of the following search (which might be run on the license server):
index=_internal source=*license_usage.log | fields pool b | stats sum(b) by pool
Another solution is to forward the license server's Splunk specific log files to your indexer(s) and perform the search there.
As a general rule, if you do not (for any operational/security reasons) have direct access (OS level, Splunk GUI) to your forwarders, license servers or indexer's Splunk (log and config) files - getting these into a place where you DO have access is really a must. Your operations people might know how to efficiently run Splunk on the operating system level - but there is no guarantee they know anything about how to manage Splunk. Splunk can be quite complex to manage - and unless the operations people are using Splunk, they will probably not care too much about how the software is supposed to work.
\Ruben