Historic License usage dashboard only shows 7 days of data

Applicability

Description

After upgrade to Splunk v10.0.1 done in 10-14-2025, the Historic License usage dashboard, that provides a default license usage view, only shows 10-7-2025 through 10-13-2025. Changing the view to be split by index, host, or other option shows the full month of data. 

Investigation

Made sure the issue was isolated to the Monitoring Console dashboards running the following search:

index=_internal source=*license_usage.log* type="Usage" earliest=-30d@d host="ct-splkcm01"
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| bin _time span=1d | stats sum(b) as b by _time, host, pool, s, st, h, idx
| join _time pool type=outer
[ search index=_internal host="ct-splkcm01" source=*license_usage* type=rolloversummary pool=* earliest=-30d@d
| eval _time=_time - 43200
| bin _time span=1d
| stats latest(poolsz) AS poolsz by slave, pool, _time
| stats max(poolsz) AS poolsz by pool, _time]
| stats sum(b) AS bytes_used max(poolsz) AS poolsz by h, _time
| timechart span=1d max(eval(round(bytes_used/poolsz*100,2))) by h fixedrange=false

If the license usage is correct in the search, then the macros of the dashboard are being accurate.

Resolution

Follow these workaround to adjust the field "slave=" to "peer=" in the macros of the Monitoring Console.

1. Go to /opt/splunk/etc/apps/splunk_monitoring_console/default/macros.conf.
2. Copy the default macros.conf and place into the local directory, creating /opt/splunk/etc/apps/splunk_monitoring_console/local/macros.conf. Note: Do not change or modify the default macros.conf, this is not recommended by Splunk for functionality purposes.
3. In the local macros.conf, change the fields "slave=" or "slaves=" to "peer=" in all the macros related to the License usage, like the example below: 

   Before

   [dmc_licensing_summery_no_split(5)]
   args = splunk_server, size_search, host, pool_clause, split_by_field_name
   definition = eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | timechart span=1d sum(b) AS "volume" fixedrange=false | `$size_search$($host$, "$pool_clause$")` | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]

   After

   [dmc_licensing_summery_no_split(5)]
   args = splunk_server, size_search, host, pool_clause, split_by_field_name
   definition = eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by peer, pool, _time | timechart span=1d sum(b) AS "volume" fixedrange=false | `$size_search$($host$, "$pool_clause$")` | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]

4. Restart splunk so the changes can be applied correctly.

Related Links

No results in "Last 30 days" tab in license usage report view

Case 3896713