Monitoring Splunk

Instrumentation License Usage Data- Why hasn't any data been sent out in the last 30 days?

atulmaxonic
Engager

Hi ,

splunk machine is not sending License Usage Data to splunk and In Instrumentation GUI it's showing No data sent in the last 30 days .while in \opt\splunk\etc\apps\splunk_instrumentation\local\telemetry.conf file ,I have setup
sendLicenceUsage=1
sendAnonymizedUsage = 0
sendAnonymizedWebAnalytics = 0
showOptInModal = 0

and In GUI License Usage Data is enabled.

plz help.

Tags (1)
0 Karma

xavierashe
Contributor

Is it because you misspelled the configuration file? It should be telemetry.conf

Here is my /opt/splunk/etc/apps/splunk_instrumentation/local/telemetry.conf:

telemetrySalt = <snip>
deploymentID = <snip>
optInVersionAcknowledged = 2
sendAnonymizedUsage = 1
sendAnonymizedWebAnalytics = 1
sendLicenseUsage = 1
showOptInModal = 0

atulmaxonic
Engager

Hi xavierashe,

thanks for sharing your knowledge with me, but after writing
optInVersionAcknowledged = 2
sendAnonymizedUsage = 1
sendAnonymizedWebAnalytics = 1
sendLicenseUsage = 1
showOptInModal = 0

to that in /opt/splunk/etc/apps/splunk_instrumentation/local/telemetry.conf ,still it is not sending LicenseUsage to splunk. it's showing No data sent in the last 30 days.

0 Karma

eregon
Path Finder

I can see two possible issues that might be causing this "No data sent" message.

 

First thing to check: is your telemetry.conf really the file that is in use? Try the following CLI command to check what is the full configuration of running instance (that means the final configuration after compiling all config files in all possible locations together):

/opt/splunk/bin/splunk btool --debug telemetry list

Check that the actual configuration matches your expectations - if it differs somewhere, you can see from what file the active value for certain option came from.

 

Second thing to check: the list of reports sent is nothing else than some data indexed within Splunk (in _telemetry index, to be specific). If you for any reason don't have the data in this index, you'll see "no data sent" even if it actually went through. Check you are examining the report from the correct instance and that _telemetry index is enabled and has meaningful configuration regarding retention limits.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...