By Splunk October 06, 2013
In my presentation at .Conf 2013, I revealed to the audience a largely unheralded but hugely beneficial feature that ships with Splunk 6.0:
index is now tracked by the license master in Splunk 6.0 and reported in license_usage.log
More than that, it is as guaranteed as sourcetype in the tuple of (source, sourcetype, host, index). This means it will not get squashed with source and host if the tuple size reaches 2000 before an indexer contacts the license master. For those of you remembering a limit of 1000, you’ll notice the default changed (in 6.0) from 1000 when the setting first became configurable via server.conf in 4.3.1.
For more information, visit the Wiki article on searching and reporting using the license_usage.log.
----------------------------------------------------
Thanks!
Brian Wooden