Monitoring Splunk

Instrumentation License Usage Data- Why hasn't any data been sent out in the last 30 days?

atulmaxonic
Engager

Hi ,

splunk machine is not sending License Usage Data to splunk and In Instrumentation GUI it's showing No data sent in the last 30 days .while in \opt\splunk\etc\apps\splunk_instrumentation\local\telemetry.conf file ,I have setup
sendLicenceUsage=1
sendAnonymizedUsage = 0
sendAnonymizedWebAnalytics = 0
showOptInModal = 0

and In GUI License Usage Data is enabled.

plz help.

Labels (1)
Tags (1)
0 Karma

xavierashe
Contributor

Is it because you misspelled the configuration file? It should be telemetry.conf

Here is my /opt/splunk/etc/apps/splunk_instrumentation/local/telemetry.conf:

telemetrySalt = <snip>
deploymentID = <snip>
optInVersionAcknowledged = 2
sendAnonymizedUsage = 1
sendAnonymizedWebAnalytics = 1
sendLicenseUsage = 1
showOptInModal = 0

atulmaxonic
Engager

Hi xavierashe,

thanks for sharing your knowledge with me, but after writing
optInVersionAcknowledged = 2
sendAnonymizedUsage = 1
sendAnonymizedWebAnalytics = 1
sendLicenseUsage = 1
showOptInModal = 0

to that in /opt/splunk/etc/apps/splunk_instrumentation/local/telemetry.conf ,still it is not sending LicenseUsage to splunk. it's showing No data sent in the last 30 days.

0 Karma

eregon
Path Finder

I can see two possible issues that might be causing this "No data sent" message.

 

First thing to check: is your telemetry.conf really the file that is in use? Try the following CLI command to check what is the full configuration of running instance (that means the final configuration after compiling all config files in all possible locations together):

/opt/splunk/bin/splunk btool --debug telemetry list

Check that the actual configuration matches your expectations - if it differs somewhere, you can see from what file the active value for certain option came from.

 

Second thing to check: the list of reports sent is nothing else than some data indexed within Splunk (in _telemetry index, to be specific). If you for any reason don't have the data in this index, you'll see "no data sent" even if it actually went through. Check you are examining the report from the correct instance and that _telemetry index is enabled and has meaningful configuration regarding retention limits.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...