Installation

Why is the Splunk License Usage report only showing daily usage data and why are all internal indexes empty?

BBakkenes
Explorer

Hello Splunkers,

We have a problem with our Splunk installation. Its a simple platform, Splunk 6.2 on one computer running Ubuntu Linux.
The problem we are experiencing is that its not possible to read out license usage report. Daily usage and percentage is working correctly. Even if we show the license report the today tab is working, but when we switch to the Previous 30 days tab its not generating anything.

I've looked up the _internal index, but it's empty.

Also I tried the following steps:

  • Installed new version of Splunk and copied etc settings needed to run with the same settings as before
  • We have the Splunk database on a different location, after new installation switched to the new location the indexes started with an underscore were disabled, so we enabled them again
  • After that we cleaned the _internal and _audit database from the CLI

But still there is no data in all the indexes starting with an underscore.

Does anyone have a clue?

Labels (2)
0 Karma
1 Solution

BBakkenes
Explorer

Splunk support figured this out, the admin role wasn't allowed to be viewed by the users.

By trying to search | dbinspect index=_internal they found that the index was working correct.

View solution in original post

BBakkenes
Explorer

Splunk support figured this out, the admin role wasn't allowed to be viewed by the users.

By trying to search | dbinspect index=_internal they found that the index was working correct.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...