topic Re: License usage over 7days in Monitoring Splunk

License usage over 7days

mvagionakis — Mon, 19 Mar 2018 09:47:17 GMT

Hello everyone,

since a while, I cannot see my license usage for more than 7 days.
At the beginning I thought that it was a bad setting on my _internal index that could drop the data over the 7 days period but I was mistaken.

I saw that beyond 7 days, there is no source like in my _internal index

license_usage.log

I double verified all my *.conf files but no parameter that could delete data.

My infrastructure consists of:

1 SH
4 Idxs
1 Master

Do you have any idea that could explain this phenomenon?

thank you in advance
Michael

ps: master and SH forwarding data to the indexers

Re: License usage over 7days

tiagofbmm — Mon, 19 Mar 2018 09:53:06 GMT

Could you have your license_usage.log checked for data longer than that?

Do you have the most recent data?

Could someone have deleted older data than those 7 days of usage? Do you always have those 7days and no more than that at all times?

Re: License usage over 7days

p_gurav — Mon, 19 Mar 2018 10:43:41 GMT

Can you try searching on indexers that license server _internal logs are coming or not?

Re: License usage over 7days

mvagionakis — Mon, 19 Mar 2018 10:45:49 GMT

Hello p_gurav,

Already done it, I have logs for exactly 7 days...when I say exactly, it is very precise, 7d0h0m0s 😞

Re: License usage over 7days

mvagionakis — Mon, 19 Mar 2018 10:47:12 GMT

hello tiagofbmm,

As I said, I have not data for license_usage.log longer than 7 days exactly.
The most recent, I have them.

None else has access , I'm the only admin.

Re: License usage over 7days

tiagofbmm — Mon, 19 Mar 2018 10:58:43 GMT

Use brook to figure out what retention period you are having on this one. It's too precise so there must be a default retention period for the internal indexes somewhere in you environment.

$SPLUNK_HOME/bin/btool indexes list --debug and check for the internal.

Re: License usage over 7days

ansif — Mon, 20 Jul 2020 18:15:25 GMT

@mvagionakis Did you find the the root cause?