Dashboards & Visualizations

After upgrading from Splunk 6.1 to 6.3, why does our license usage report show incorrect results?

athorat
Communicator

We are using this search for a Splunk license usage dashboard. it works fine in Splunk 6.1, but when we run this from a 6.3 search head, it gives twice the values.

We switched off the load balancer pointing to the the old search head now have invalid data.

index=_internal source=*license_usage.log* type=Usage | timechart span=1d sum(b) as bytes | eval GB = round(bytes/1024/1024/1024,5) | fields _time GB

Thanks,
Anil.

0 Karma

maciep
Champion

Do you have a license master in your environment? Does Splunk's Licensing dashboard display correct results? Have you looked at the raw events from your search to see if there are unexpected hosts/sources/etc included in the data that might explain the skewed numbers?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...