We have a problem with our Splunk installation. Its a simple platform, Splunk 6.2 on one computer running Ubuntu Linux. The problem we are experiencing is that its not possible to read out license usage report. Daily usage and percentage is working correctly. Even if we show the license report the today tab is working, but when we switch to the Previous 30 days tab its not generating anything.
I've looked up the _internal index, but it's empty.
Also I tried the following steps:
Installed new version of Splunk and copied etc settings needed to run with the same settings as before
We have the Splunk database on a different location, after new installation switched to the new location the indexes started with an underscore were disabled, so we enabled them again
After that we cleaned the _internal and _audit database from the CLI
But still there is no data in all the indexes starting with an underscore.