Why is the Splunk License Usage report only showing daily usage data and why are all internal indexes empty?

[BBakkenes]

Hello Splunkers,

We have a problem with our Splunk installation. Its a simple platform, Splunk 6.2 on one computer running Ubuntu Linux.
The problem we are experiencing is that its not possible to read out license usage report. Daily usage and percentage is working correctly. Even if we show the license report the today tab is working, but when we switch to the Previous 30 days tab its not generating anything.

I've looked up the _internal index, but it's empty.

Also I tried the following steps:

• Installed new version of Splunk and copied etc settings needed to run with the same settings as before
• We have the Splunk database on a different location, after new installation switched to the new location the indexes started with an underscore were disabled, so we enabled them again
• After that we cleaned the _internal and _audit database from the CLI

But still there is no data in all the indexes starting with an underscore.

Does anyone have a clue?

[BBakkenes · Accepted solution]

Splunk support figured this out, the admin role wasn't allowed to be viewed by the users.

By trying to search | dbinspect index=_internal they found that the index was working correct.