Installation

Why is the Splunk License Usage report only showing daily usage data and why are all internal indexes empty?

BBakkenes
Explorer

Hello Splunkers,

We have a problem with our Splunk installation. Its a simple platform, Splunk 6.2 on one computer running Ubuntu Linux.
The problem we are experiencing is that its not possible to read out license usage report. Daily usage and percentage is working correctly. Even if we show the license report the today tab is working, but when we switch to the Previous 30 days tab its not generating anything.

I've looked up the _internal index, but it's empty.

Also I tried the following steps:

  • Installed new version of Splunk and copied etc settings needed to run with the same settings as before
  • We have the Splunk database on a different location, after new installation switched to the new location the indexes started with an underscore were disabled, so we enabled them again
  • After that we cleaned the _internal and _audit database from the CLI

But still there is no data in all the indexes starting with an underscore.

Does anyone have a clue?

Labels (2)
0 Karma
1 Solution

BBakkenes
Explorer

Splunk support figured this out, the admin role wasn't allowed to be viewed by the users.

By trying to search | dbinspect index=_internal they found that the index was working correct.

View solution in original post

BBakkenes
Explorer

Splunk support figured this out, the admin role wasn't allowed to be viewed by the users.

By trying to search | dbinspect index=_internal they found that the index was working correct.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...