Splunk Enterprise

Why is Historical license usage page showing blank?

HX
Engager

Historical license usage is not showing some days' graph, but the data are all there. 

usage.png

The search string is this, never changed, it worked well before.

(index=_internal host=xxxxxx source=*license_usage.log* type="RolloverSummary" earliest=-30d@d)
| eval _time=('_time' - 43200)
| bin _time span=1d
| stats latest(b) AS b by slave, pool, _time
| timechart span=1d sum(b) AS "volume" fixedrange=false
| join type=outer _time
[| search (index=_internal host=xxxxxxx source=*license_usage.log* type="RolloverSummary" earliest=-30d@d)
| eval _time=('_time' - 43200)
| bin _time span=1d
| dedup _time stack
| stats sum(stacksz) AS "stack size" by _time]
| fields - _timediff
| foreach "*"
[ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3) ]

Labels (1)
0 Karma

plymalebl
Explorer

I had this same issue after upgrading to Splunk 9.1.0.2 and found there was a missing choice value under the All Pools option inside of the view $SPLUNK_HOME$/etc/apps/splunk_monitoring_console/default/data/ui/views/license_usage_historic.xml 

 

You will need to go in and manually update the xml at CLI or with the text editor of your choice. Adjust the choice value for the input from the blank value to the asterisk wildcard as shown below.

 

 

<input type="dropdown" searchWhenChanged="true" token="pool">
      <label>Pool</label>
      <showClearButton>false</showClearButton>
      <fieldForLabel>name</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <search>
        <query>
          | rest splunk_server=$splunk_server$ /services/licenser/pools | rename title AS pool | search [rest splunk_server=$splunk_server$ /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval name=pool | eval value="pool=\"". pool . "\"" | table name value
        </query>
      </search>
      <choice value="*">All Pools</choice>
      <default>All Pools</default>
      <change>
        <condition value=" ">
          <set token="size_search">dmc_licensing_stack_size_srch</set>
          <set token="sz_clause">stacksz</set>
        </condition>
        <condition value="*">
          <set token="size_search">dmc_licensing_pool_size_srch</set>
          <set token="sz_clause">poolsz</set>
        </condition>
      </change>
    </input>

 

 

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...