License server don't show 30 days license usage

fabiolabruzzo — Thu, 13 Jan 2022 14:18:06 GMT

Hello,

in my deploy server, that act as a LM, i cannot see Licese Usage Report for 30-day period.

It always shows "No results found". For the "today" report i can see data.

Looking at ../var/splunk folder i can see the license_usage.log file but there's no

type=Rollover_Summary

inside.

There's only type=Usage.

Could you help me check this issue?
Thanks a log

Re: License server don't show 30 days license usage

Stefanie — Thu, 13 Jan 2022 18:09:36 GMT

I've had this same issue. I was able to resolve it by ensuring that my Deployment Server is set to a "search head" along with being a deployment server.

Are you receiving other _internal logs from your deployment server?

Run this query on your search head:

index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | timechart span=1d sum(b) AS "volume" fixedrange=false | join type=outer _time [search index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(stacksz) AS "stack size" by _time] | fields - _timediff | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]

If this search works then that means your Deployment Server is not configured to search within it's own logs.

topic License server don't show 30 days license usage in Splunk Enterprise

License server don't show 30 days license usage

Re: License server don't show 30 days license usage