Splunk Monitoring Console "Historic License Usage" Dashboard Fails Due to Deprecated 'slave' Terminology

Applicability

Description

Users who are observing the "Historic License Usage" dashboard within the Splunk Monitoring Console may notice that certain panels, including "Daily License Usage," "Percentage of Daily License Quota Used," and "Average and Peak Daily Volume," appear to be empty or display the message "No results found." 

The underlying issue stems from specific internal Splunk Monitoring Console macros and searches that continue to reference the deprecated field "slave" instead of the updated field "peer" in the more recent versions of Splunk. This discrepancy can lead to confusion and hinder the accurate monitoring of license usage, ultimately affecting the overall performance and efficiency of the system.
 

Investigation

1. Initial Observation: The "Historic License Usage" dashboard exhibited a status of "No results found" for all the panel on the License dashboard
   
2. Search Analysis: The upper panel of the dashboard was selected to run the search query.
   
3. Macro Examination: The macro dmc_licensing_summary_no_split was initiated and reviewed as a new search.
   
4. Search Execution: Executing this search yielded 330 events, but it did not produce any statistical results.
   
5. Field Verification: Utilizing verbose mode, it was confirmed that there was no field designated as "slave" present within the event data.
   
6. Search Modification: The removal of the term "slave" from the search query facilitated the generation of statistics, thereby indicating that the field name itself constituted the underlying issue.
   

Resolution

1. Proposed Replacement: The substitution of the term "slave" with "peer" in the search query has produced statistically significant and anticipated results.
   
2. Configuration Check: A thorough examination of the macros.conf file located within the Splunk Enterprise(splunk/etc/apps/splunk_monitoring_console/default/macros.conf) 10.0.2 Monitoring Console RPM has confirmed that a number of references to "slave" remain embedded within the macros, Splunk's official transition from "master/slave" to the terminology of "manager/peer" 
   
   
   

Ensure that the modified macro definitions are correctly saved and deployed across your Splunk environment. This typically involves restarting relevant Splunk components or refreshing the configuration.

By updating these references, the Monitoring Console dashboards will be able to correctly retrieve and display license usage statistics, aligning with Splunk's current terminology standards.

Related Links

Community reference