Which Splunk internal index contains license-related events?
Which Splunk internal index contains license-related events?
The Splunk internal index that contains license-related events is _internal. This index stores various internal logs, including those related to licensing information, making it possible to monitor and manage license usage within Splunk.
https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/LicenseUsageReportViewexamples
Answer C
A. _audit, is for audit B. _license, do not exist C. _internal, have license data D. _introspection, is use for splunk performance diag.
_internal
https://docs.splunk.com/Documentation/Splunk/8.2.6/Admin/LicenseUsageReportViewexamples
C is correct