Monitoring Console license usage shows Previous 60 days but only 30 days of results

Applicability

Description

The Monitoring Console license usage view shows a tab named Previous 60 days, but the available results cover only the last 30 days.

The tab label does not match the search range of the built-in report, and the _internal index that stores license usage events keeps data for 30 days by default (frozenTimePeriodInSecs = 2592000). A lookback longer than 30 days, such as 45 days of license overage or warning history, cannot be completed from the built-in report.

Investigation

1. Open the license usage report in the Monitoring Console and compare the Previous 60 days tab label with the earliest date shown in the results. The earliest date is about 30 days before the current date.

2. Confirm the effective retention value for the _internal index on each indexer that stores it:

splunk btool indexes list _internal --debug

A frozenTimePeriodInSecs value of 2592000 confirms the default 30-day retention.

Resolution

A longer history needs both retained data and a search range that covers it.

1. Confirm that the indexers have enough free disk space for the longer retention. The time limit is not a guarantee, because maxTotalDataSizeMB can roll buckets to frozen before frozenTimePeriodInSecs is reached.

2. On each indexer that stores the _internal index, add the following stanza to indexes.conf by using the approved configuration method for the environment. In Splunk Enterprise, custom values belong in $SPLUNK_HOME/etc/system/local/indexes.conf.

[_internal]
frozenTimePeriodInSecs = 4320000

4320000 seconds is 50 days. Use 5184000 for 60 days.

3. Restart the instance during an approved change window. Configuration changes to indexes.conf take effect after a restart.

4. Re-run the btool command from the Investigation section and confirm the new value.

5. After the retained data covers the required period, review license history with a search or report scoped to that longer range. The built-in report continues to cover 30 days.

Retention grows forward from the change. Data already rolled to frozen is not recovered, and frozen data is deleted unless a cold-to-frozen script or path is configured. To roll back, restore the previous value and restart; the longer retention increases disk usage until the value is reverted. Stop and revert if free disk space approaches the configured minimum.

The default value and setting behavior were checked against the Splunk Enterprise 10.6 reference; confirm the effective values on the running version.

Related Links

Splunk Known Issues: The license usage report tab name is Previous 60 days, but the reports run over the last 30 days