https://community.splunk.com/t5/Dashboards-Visualizations/After-upgrading-from-Splunk-6-1-to-6-3-why-does-our-license/m-p/234118#M14483 <P>Do you have a license master in your environment? Does Splunk's Licensing dashboard display correct results? Have you looked at the raw events from your search to see if there are unexpected hosts/sources/etc included in the data that might explain the skewed numbers? </P> Sat, 05 Mar 2016 14:09:21 GMT maciep 2016-03-05T14:09:21Z https://community.splunk.com/t5/Dashboards-Visualizations/After-upgrading-from-Splunk-6-1-to-6-3-why-does-our-license/m-p/234117#M14482 <P>We are using this search for a Splunk license usage dashboard. it works fine in Splunk 6.1, but when we run this from a 6.3 search head, it gives twice the values.</P> <P>We switched off the load balancer pointing to the the old search head now have invalid data.</P> <PRE><CODE>index=_internal source=*license_usage.log* type=Usage | timechart span=1d sum(b) as bytes | eval GB = round(bytes/1024/1024/1024,5) | fields _time GB </CODE></PRE> <P>Thanks,<BR /> Anil.</P> Sat, 05 Mar 2016 01:59:32 GMT https://community.splunk.com/t5/Dashboards-Visualizations/After-upgrading-from-Splunk-6-1-to-6-3-why-does-our-license/m-p/234117#M14482 athorat 2016-03-05T01:59:32Z https://community.splunk.com/t5/Dashboards-Visualizations/After-upgrading-from-Splunk-6-1-to-6-3-why-does-our-license/m-p/234118#M14483 <P>Do you have a license master in your environment? Does Splunk's Licensing dashboard display correct results? Have you looked at the raw events from your search to see if there are unexpected hosts/sources/etc included in the data that might explain the skewed numbers? </P> Sat, 05 Mar 2016 14:09:21 GMT https://community.splunk.com/t5/Dashboards-Visualizations/After-upgrading-from-Splunk-6-1-to-6-3-why-does-our-license/m-p/234118#M14483 maciep 2016-03-05T14:09:21Z