Splunk Search

Why does my search for 14 Day License usage only seem to show a rolling 3 days worth of log files?

Esky73
Builder

Here's my search:

index=_internal  source=*license_usage.log* type=Usage (idx="main") | bucket span=1d _time | stats sum(b) as bytes by _time idx | eval gb=round(bytes/1024/1024/1024,3) | fields - bytes| timechart sum(gb) by idx limit=20

Output looks like this below. Not sure why it's happening. I thought it was because I only had 3 days worth of log files, but the meta data should be stored in the _internal index right?

main

2016-08-09

2016-08-10

2016-08-11

2016-08-12

2016-08-13

2016-08-14

2016-08-15

2016-08-16

2016-08-17

2016-08-18

2016-08-19

2016-08-20

2016-08-21 0.002
2016-08-22 0.046
2016-08-23 0.032

0 Karma
1 Solution

Esky73
Builder

there seems to be a bug in our env (6.2.3) where none of the DMC data was being populated properly. The workaround was to go into the DMC on the master node > select setup > and apply which seemed to restore all the dashboards.

View solution in original post

0 Karma

Esky73
Builder

there seems to be a bug in our env (6.2.3) where none of the DMC data was being populated properly. The workaround was to go into the DMC on the master node > select setup > and apply which seemed to restore all the dashboards.

0 Karma

inventsekar
Ultra Champion

source=license_usage.log////
The correct source is the full path of that license_usage.log file. To correct that, you can add a * before.

please try

by sourcetype -

index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by st useother=false

by indexer -

index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by i useother=false 
0 Karma

Esky73
Builder

OK for some reason the MN where the app is running is not populating the _internal for more than ~3 days.

If i run the search on the SH i get what i expect - the last 14 days of usage

MN is the Master License

0 Karma

inventsekar
Ultra Champion

Hi, Great to know that SH reports 14 day license usage.
if the issue was resolved, could you please accept this as the answer, thanks.

0 Karma

Esky73
Builder

there seems to be a bug in our env (6.2.3) where none of the DMC data was being populated properly. The workaround was to go into the DMC on the master node > select setup > and apply which seemed to restore all the dashboards.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...