As a best practice, the internal licensing logs should be stored on the license server. The license

server is a Splunk instance that manages the distribution and enforcement of licenses in a Splunk

deployment. The license server generates internal licensing logs that contain information about the

license usage, violations, warnings, and pools. The internal licensing logs should be stored on the

license server itself, because they are relevant to the license server’s role and function. Storing the

internal licensing logs on the license server also simplifies the license monitoring and

troubleshooting process. The internal licensing logs should not be stored on the indexing layer, the

deployment layer, or the search head layer, because they are not related to the roles and functions of

these layers. Storing the internal licensing logs on these layers would also increase the network

traffic and disk space consumption