I'm trying to use the license_usage.log as a way to track source(type) volume on a per index basis, something not really possible with METRICS logs. But I see sometimes the s and/or st and/or h fields are empty. Why is this? Samples:
05-10-2017 15:47:03.209 -0400 INFO LicenseUsage - type=Usage s="/app/tomcatprofile/xxx/logs/some-services.log" st=sc_tomcat h=somehost o="" idx="smartconnect" i="GUID1" pool="Staging" b=145 poolsz=524288000000
05-10-2017 15:49:05.582 -0400 INFO LicenseUsage - type=Usage s="" st=sc_tomcat h="" o="" idx="smartconnect" i="GUID2" pool="Staging" b=43643 poolsz=524288000000
EDIT: Is this related to the metrics tracking limits? The same mechanism in the background is providing this numbers, and so if a particular source, sourcetype, or host is not in the top 10 (or whatever you have your limits set to), you get an empty string?
This will periodically happen for host (h) or source (s) values. It is related to squashing of the values. A good answer of why this occurs is given here: https://answers.splunk.com/answers/48542/blank-h-and-s-in-license-usage-log.html
The sc_tomcat sourcetype has only one input defined. The first log shows it, the second leaves it out.