Reporting

License Usage Report for 30 days only shows part of the month

chrislibby
Engager

My License Usage Report is missing about half of the last 30 days, no matter what pool or split I look at. It's a simple setup - one server running everything.

0 Karma

jensonthottian
Contributor

That could be because the data could have been already purged for last half.

Go to settings and click on Indexes:
What is the Max size (MB) of entire index set for _internal index??
You will also see a column - Earliest event ..what is the earliest event there?

0 Karma

yannK
Splunk Employee
Splunk Employee

yes the _internal index retention are 30days and 500Mb, so if may have deleted the oldest events already if the size reached 500 in less than one month.

0 Karma

chrislibby
Engager

The max size is 500mb, the current size is 905mb. The earliest event is 6/22/15, and the latest event is 8/21/15 current time. Could it be the size?

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...