Getting Data In

Why are some keys in license_usage.log empty?

twinspop
Influencer

I'm trying to use the license_usage.log as a way to track source(type) volume on a per index basis, something not really possible with METRICS logs. But I see sometimes the s and/or st and/or h fields are empty. Why is this? Samples:

05-10-2017 15:47:03.209 -0400 INFO  LicenseUsage - type=Usage s="/app/tomcatprofile/xxx/logs/some-services.log" st=sc_tomcat h=somehost o="" idx="smartconnect" i="GUID1" pool="Staging" b=145 poolsz=524288000000

05-10-2017 15:49:05.582 -0400 INFO  LicenseUsage - type=Usage s="" st=sc_tomcat h="" o="" idx="smartconnect" i="GUID2" pool="Staging" b=43643 poolsz=524288000000

EDIT: Is this related to the metrics tracking limits? The same mechanism in the background is providing this numbers, and so if a particular source, sourcetype, or host is not in the top 10 (or whatever you have your limits set to), you get an empty string?

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

This will periodically happen for host (h) or source (s) values. It is related to squashing of the values. A good answer of why this occurs is given here: https://answers.splunk.com/answers/48542/blank-h-and-s-in-license-usage-log.html

0 Karma

twinspop
Influencer

The sc_tomcat sourcetype has only one input defined. The first log shows it, the second leaves it out.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...