The daily licensing page shows that we are within the 2 TB license. However, the Usage report from the Licensing page for the past 30 days shows that we consistently pass the 5 TB mark. What can it be?
Actually with no split, it's good and with a split by Source type it's off -
Which version of splunk are you running ?
Hi!
Can you check if a "total" of all the splitted values is also getting added at the end of the usage report from the licensing page for the past 30 days?
Not sure I understand your question ; -)
Can you share the search of this panel and the statistical output of the search?