Product documentation
uberAgent
Current Release (7.3.0) 7.2.1 7.2.0 7.1.2 7.1.1 7.1.0 7.0.2 7.0.1 7.0.0
View PDF

The Data Volume Dashboard Does Not Display Values For All Metrics

July 25, 2024
Contributed by: 
C

Symptom

The data volume dashboard only displays "N/A" for the volume of some or all metrics.

Possible Cause: Splunk Configuration

The data volume dashboard queries Splunk’s _internal index which in turn reads that data from Splunk’s log file license_usage.log. By default, every Splunk indexer periodically reports to the license manager stats of the data indexed: broken down by source, source type, host, and index. If the number of distinct (source, source type, host, index) tuples grows over the squash_threshold, Splunk squashes the {host, source} values and only reports a breakdown by {sourcetype, index}. This is to prevent high memory usage and an unwieldy number of license_usage.log lines.

Resolution

Increase the squash_threshold by adding the following to $SPLUNK_HOME/etc/system/local/server.conf:

[license]
squash_threshold = 10000
<!--NeedCopy-->

You will find more information here.

Possible Cause: Permissions

Your user account might not have permissions for the index _internal. To check first go to Settings -> Access controls -> Users -> Your user name and note the roles assigned to you. Then go to Settings -> Access controls -> Roles and check if any of your roles has either _internal or All internal indexes in the box Selected search indexes, i.e. one of these:

uberAgent-internal-index-permissions-small

Resolution

Assign either _internal or All internal indexes to Selected search indexes of one of your roles.

The Data Volume Dashboard Does Not Display Values For All Metrics
July 25, 2024
Contributed by: 
C
July 25, 2024
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.