topic License usage reporting not showing any data in Reporting

License usage reporting not showing any data

rakeshcse2 — Thu, 22 Sep 2016 11:23:39 GMT

Our Splunk enterprise environment consists of 3 index servers, one search server and one master deployment server.

We are using splunk version 6.2.4.

Can someone please let me know why the deployment server is not showing the license usage graphs ? Please refer attached screen shot.

Re: License usage reporting not showing any data

schose — Thu, 22 Sep 2016 14:41:42 GMT

Hi,

The dashboards are executing index=_internal source=*license_usage.log behind the scenes. I would guess that the instance you are running the dashboards is not definded as a searchhead or it's not forwarding it's own events to the indexers.
Try to run the following search from your search head:

index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d   | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | timechart span=1d sum(b) AS "volume" fixedrange=false | join type=outer _time [search index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(stacksz) AS "stack size" by _time] | fields - _timediff  | foreach * [eval <>=round('<>'/1024/1024/1024, 3)]

Regards,

Andreas

Re: License usage reporting not showing any data

rakeshcse2 — Thu, 22 Sep 2016 15:35:44 GMT

The search with index=_internal is working and showing the license usage details, also the server is configured as a search head too under server roles. Still, the graphs are not populating. What else could be missing?

App_->DMC--->Setup-->Serverroles ---Cluster Master
Deployment Server
Indexer
License Master
Search Head

Re: License usage reporting not showing any data

kgrigsby_splunk — Wed, 26 Apr 2017 00:18:21 GMT

Problem:
One particular Splunk report is reporting back with no data, though the dashboard is showing data, and test reports are working as expected.

Problem Description:
Report detailing diskspace and license usage does not send correctly. Many panels report no data when scheduled, but show fine within Splunk, or in a test report.

Recommendation:
Go to 'Access Controls > Users.' Previous customer realized he didn't change the role back to admin after he finished doing some testing on a custom role he was testing out. Switched it over to his LDAP account and it works just fine now.

Solution:
Customer fixed the issue. The report was sending from customer's local account, which did not have admin rights, and therefore could not search/report on the _internal index.