Blank spaces in license usage report when splitting by host and source

Applicability

Description

When splitting the license usage by host, the report will show some blank spaces as shown in the screenshot taken from a sheet below:


 

Investigation

Every indexer periodically reports to the License Manager the stats of the data indexed: broken down by source, source type, host, and index.

If the number of distinct (source, source type, host, index) tuples grows over the squash_threshold, Splunk squashes the (host, source} values and only reports a breakdown by {sourcetype, index}. 

Because of squashing on the other fields, only the split-by-source type and index will guarantee full reporting (every byte). Split by source and host does not necessarily guarantee full reporting.

Resolution

To avoid this, squashing can be configured in the server.conf file in the [license] stanza with the squash_threshold attribute.

Increase the value, however, this has to be done with care because this may lead to high memory usage.

[license]
squash_threshold =

squash_threshold = <positive integer>
* Advanced setting.  Periodically the indexer must report to license manager
  the data indexed broken down by source, sourcetype, host, and index.  If
  the number of distinct (source, sourcetype, host, index) tuples grows over
  the 'squash_threshold', the (host, source) values are squashed and only a
  breakdown by (sourcetype, index) is reported. This is to prevent explosions in
  memory + license_usage.log lines.
* Set this only after consulting a Splunk Support engineer.
* This needs to be set on license slaves as well as license
  master.
* Default: 2000

Related Links

Splunk Documentation
About Splunks License Usage Report View