Splunk Enterprise

Why is Historical license usage page showing blank?

HX
Engager

Historical license usage is not showing some days' graph, but the data are all there. 

usage.png

The search string is this, never changed, it worked well before.

(index=_internal host=xxxxxx source=*license_usage.log* type="RolloverSummary" earliest=-30d@d)
| eval _time=('_time' - 43200)
| bin _time span=1d
| stats latest(b) AS b by slave, pool, _time
| timechart span=1d sum(b) AS "volume" fixedrange=false
| join type=outer _time
[| search (index=_internal host=xxxxxxx source=*license_usage.log* type="RolloverSummary" earliest=-30d@d)
| eval _time=('_time' - 43200)
| bin _time span=1d
| dedup _time stack
| stats sum(stacksz) AS "stack size" by _time]
| fields - _timediff
| foreach "*"
[ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3) ]

Labels (1)
0 Karma

plymalebl
Explorer

I had this same issue after upgrading to Splunk 9.1.0.2 and found there was a missing choice value under the All Pools option inside of the view $SPLUNK_HOME$/etc/apps/splunk_monitoring_console/default/data/ui/views/license_usage_historic.xml 

 

You will need to go in and manually update the xml at CLI or with the text editor of your choice. Adjust the choice value for the input from the blank value to the asterisk wildcard as shown below.

 

 

<input type="dropdown" searchWhenChanged="true" token="pool">
      <label>Pool</label>
      <showClearButton>false</showClearButton>
      <fieldForLabel>name</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <search>
        <query>
          | rest splunk_server=$splunk_server$ /services/licenser/pools | rename title AS pool | search [rest splunk_server=$splunk_server$ /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval name=pool | eval value="pool=\"". pool . "\"" | table name value
        </query>
      </search>
      <choice value="*">All Pools</choice>
      <default>All Pools</default>
      <change>
        <condition value=" ">
          <set token="size_search">dmc_licensing_stack_size_srch</set>
          <set token="sz_clause">stacksz</set>
        </condition>
        <condition value="*">
          <set token="size_search">dmc_licensing_pool_size_srch</set>
          <set token="sz_clause">poolsz</set>
        </condition>
      </change>
    </input>

 

 

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...