Stats missing on 9.2 Indexes page

[sbur2467]

My company had a Splunk 8.0 server that hadn't been upgraded in years.  There was a lot of abandoned testing on it over the years so cleanup and multiple upgrades to get to 9.2.1 was going to be a big undertaking.  I decided to stand up a new server with 9.2.1 and migrate over the data.  We went live on it a few weeks ago.  We've had no issues with ingesting data or searches or alerts.  However the Indexes page under Settings shows 0 on all indexes for Current Size and Event Count.  Earliest Event and Latest Event are all blank.  This is happening on all the indexes, both internal and non-internal. 

We noticed this before go live and talked to support.  They said it was because of the trial license we were using and would go away when we put our real license on it during go live. We did the license switch during go live but we're still seeing 0 for everything.  We can search on these indexes so there is data in them.  I don't see any errors in the logs when we go to the indexes page.

If I go to Indexes and Volumes: Instances in the Monitoring console under snapshots it shows my bucket count and space used on the file system but index usage is 0 for everything.  Under historical it does show the index sizes.

[sbur2467 · Accepted solution]

I finally figured out the issue.  We have Splunk Observability Cloud.  I had setup Log Observer to connect to the Enterprise instance.  Part of the setup is to add indexes_list_all to the authorize.conf file and make sure it's not checked for the new role you create for LO.  I didn't realize without that entry in authorize.conf it was enabled for all roles.  Once I added the capability in the file it became disabled for all roles.  I added that to the admin role and now all the stats are displaying on the indexes page.