Installation

Where is the indexname in the license usage log entries (upgrading from 6.1 to 6.4.1)?

a212830
Champion

Hi,

We went from 6.1 to 6.4.1 recently, and noticed that the index that is reporting the license information is now some type of guid, rather than the actual name (See below). How do I get the name for the index?

10-16-2016 23:59:59.375 -0400 INFO LicenseUsage - type=Usage s="udp:5514" st="udp:5514" h="172.25.62.28" o="" idx="default_udp514" i="4B832E19-9B4D-4073-89DB-0B473D1D2623" pool="auto_generated_pool_enterprise" b=8608 poolsz=3886945402880

Labels (2)
0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

update -
the "idx" is the index name and
the "i" is the indexer name

10-16-2016 23:59:59.375 -0400 INFO LicenseUsage - type=Usage s="udp:5514" st="udp:5514" h="172.25.62.28" o="" idx="default_udp514" i="4B832E19-9B4D-4073-89DB-0B473D1D2623" pool="auto_generated_pool_enterprise" b=8608 poolsz=3886945402880

View solution in original post

inventsekar
SplunkTrust
SplunkTrust

Hi, please find the updated answer -
the "idx" is the index name and
the "i" is the indexer name

0 Karma

inventsekar
SplunkTrust
SplunkTrust

update -
the "idx" is the index name and
the "i" is the indexer name

10-16-2016 23:59:59.375 -0400 INFO LicenseUsage - type=Usage s="udp:5514" st="udp:5514" h="172.25.62.28" o="" idx="default_udp514" i="4B832E19-9B4D-4073-89DB-0B473D1D2623" pool="auto_generated_pool_enterprise" b=8608 poolsz=3886945402880

Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...