Why do we see a discrepancy between the daily licensing page and the Usage report for the past 30 days?

[ddrillic]

The daily licensing page shows that we are within the 2 TB license. However, the Usage report from the Licensing page for the past 30 days shows that we consistently pass the 5 TB mark. What can it be?

Actually with no split, it's good and with a split by Source type it's off -

[harsmarvania57]

Which version of splunk are you running ?

[MousumiChowdhur]

Hi!

Can you check if a "total" of all the splitted values is also getting added at the end of the usage report from the licensing page for the past 30 days?

[ddrillic]

Not sure I understand your question ; -)

[MousumiChowdhur]

Can you share the search of this panel and the statistical output of the search?