Monitoring Splunk

Instrumentation License Usage Data- Why hasn't any data been sent out in the last 30 days?

atulmaxonic
Engager

Hi ,

splunk machine is not sending License Usage Data to splunk and In Instrumentation GUI it's showing No data sent in the last 30 days .while in \opt\splunk\etc\apps\splunk_instrumentation\local\telemetry.conf file ,I have setup
sendLicenceUsage=1
sendAnonymizedUsage = 0
sendAnonymizedWebAnalytics = 0
showOptInModal = 0

and In GUI License Usage Data is enabled.

plz help.

Labels (1)
Tags (1)
0 Karma

xavierashe
Contributor

Is it because you misspelled the configuration file? It should be telemetry.conf

Here is my /opt/splunk/etc/apps/splunk_instrumentation/local/telemetry.conf:

telemetrySalt = <snip>
deploymentID = <snip>
optInVersionAcknowledged = 2
sendAnonymizedUsage = 1
sendAnonymizedWebAnalytics = 1
sendLicenseUsage = 1
showOptInModal = 0

atulmaxonic
Engager

Hi xavierashe,

thanks for sharing your knowledge with me, but after writing
optInVersionAcknowledged = 2
sendAnonymizedUsage = 1
sendAnonymizedWebAnalytics = 1
sendLicenseUsage = 1
showOptInModal = 0

to that in /opt/splunk/etc/apps/splunk_instrumentation/local/telemetry.conf ,still it is not sending LicenseUsage to splunk. it's showing No data sent in the last 30 days.

0 Karma

eregon
Path Finder

I can see two possible issues that might be causing this "No data sent" message.

 

First thing to check: is your telemetry.conf really the file that is in use? Try the following CLI command to check what is the full configuration of running instance (that means the final configuration after compiling all config files in all possible locations together):

/opt/splunk/bin/splunk btool --debug telemetry list

Check that the actual configuration matches your expectations - if it differs somewhere, you can see from what file the active value for certain option came from.

 

Second thing to check: the list of reports sent is nothing else than some data indexed within Splunk (in _telemetry index, to be specific). If you for any reason don't have the data in this index, you'll see "no data sent" even if it actually went through. Check you are examining the report from the correct instance and that _telemetry index is enabled and has meaningful configuration regarding retention limits.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...