Monitoring Console: Historic license usage dashboard returns "No results found."

Applicability

Description

When accessing the Monitoring Console > Indexing > License Usage > Historic License Usage dashboard, the panel may display the message “No results found”.

To verify the behavior:

1. Navigate to Settings > Monitoring Console.

2. Open the Indexing >License Usage > Historic License Usage dashboard.

3. Check if the Daily License Usage are displaying data.

4. Confirm if the issue is reproducible across all instances or only on specific roles (for example, Enterprise Security  Search Head (ES SH) vs. Ad-hoc SH vs License Manager).

Investigation

To confirm whether this issue is occurring:

1. Review the Monitoring Console logs and check if the ingest volume chart is empty.

2. Check the contents of the dmc_assets lookup to see if the serverName entries are out of date.

3. Verify whether the instance has recently undergone a server name change or been restarted.

Resolution

As a workaround, regenerate the dmc_assets lookup with the correct serverName.

1. In Splunk Web, go to Settings > Monitoring Console > Run a Search.
2. Run the following search:

   | inputlookup append=true dmc_assets 
   | append 
       [| `dmc_get_local_instance_asset` 
       | rename search_groups AS search_group] 
   | stats last(*) AS * by peerURI, search_group 
   | fields peerURI serverName host machine search_group
   | outputlookup dmc_assets

3. After running this search, the dmc_assets lookup will be updated with the latest server information.

Important: If the server name changes in the future (for example, after a server restart), you should run this search again as a workaround until the issue is addressed in a future release.