Symptom
The data volume dashboard only displays "N/A" for the volume of some or all metrics.
Possible Cause: Splunk Configuration
The data volume dashboard queries Splunk's _internal index which in turn reads that data from Splunk's log file metrics.log. By default Splunk only logs throughput for up to ten sourcetypes.
Resolution
Configure Splunk to log data for all sourcetypes by adding the following to $SPLUNK_HOME/etc/system/local/limits.conf:
[metrics] maxseries = integer
Choose integer so that it is larger than the number of sourcetypes.
This configuration change is required on the indexers only.
Possible Cause: Permissions
Your user account might not have permissions for the index _internal. To check first go to Settings -> Access controls -> Users -> Your user name and note the roles assigned to you. Then go to Settings -> Access controls -> Roles and check if any of your roles has either _internal or All internal indexes in the box Selected search indexes, i.e. one of these:
Resolution
Assign either _internal or All internal indexes to Selected search indexes of one of your roles.
0 Comments