License Usage for the last 30 days

[karlhenderson]

When I try to get License Usage for the last 30 days via the Monitoring Console, I only get the last day (the day before the current date). Looking at the events, it appears that RolloverSummary is ONLY stored for a single day. In other words, there are NO events with RolloverSummary for days past the day before the current date.

Need help fixing this problem.

[isoutamo]

RolloverSummary is updated once a day. Usually this will happened on midnight. Are your splunk instance running at this time?

[karlhenderson]

It may be a retention size issue as we were at 99%. I just increased it so we'll see in another day. However, I do have events for 30 days in the _internal index - just not events with RolloverSummery