Splunk Enterprise

Why is Historical license usage page showing blank?

HX
Engager

Historical license usage is not showing some days' graph, but the data are all there. 

usage.png

The search string is this, never changed, it worked well before.

(index=_internal host=xxxxxx source=*license_usage.log* type="RolloverSummary" earliest=-30d@d)
| eval _time=('_time' - 43200)
| bin _time span=1d
| stats latest(b) AS b by slave, pool, _time
| timechart span=1d sum(b) AS "volume" fixedrange=false
| join type=outer _time
[| search (index=_internal host=xxxxxxx source=*license_usage.log* type="RolloverSummary" earliest=-30d@d)
| eval _time=('_time' - 43200)
| bin _time span=1d
| dedup _time stack
| stats sum(stacksz) AS "stack size" by _time]
| fields - _timediff
| foreach "*"
[ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3) ]

Labels (1)
0 Karma

plymalebl
Explorer

I had this same issue after upgrading to Splunk 9.1.0.2 and found there was a missing choice value under the All Pools option inside of the view $SPLUNK_HOME$/etc/apps/splunk_monitoring_console/default/data/ui/views/license_usage_historic.xml 

 

You will need to go in and manually update the xml at CLI or with the text editor of your choice. Adjust the choice value for the input from the blank value to the asterisk wildcard as shown below.

 

 

<input type="dropdown" searchWhenChanged="true" token="pool">
      <label>Pool</label>
      <showClearButton>false</showClearButton>
      <fieldForLabel>name</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <search>
        <query>
          | rest splunk_server=$splunk_server$ /services/licenser/pools | rename title AS pool | search [rest splunk_server=$splunk_server$ /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval name=pool | eval value="pool=\"". pool . "\"" | table name value
        </query>
      </search>
      <choice value="*">All Pools</choice>
      <default>All Pools</default>
      <change>
        <condition value=" ">
          <set token="size_search">dmc_licensing_stack_size_srch</set>
          <set token="sz_clause">stacksz</set>
        </condition>
        <condition value="*">
          <set token="size_search">dmc_licensing_pool_size_srch</set>
          <set token="sz_clause">poolsz</set>
        </condition>
      </change>
    </input>

 

 

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...