The Data Volume Dashboard Does Not Display Values For All Metrics

Symptom

The data volume dashboard only displays "N/A" for the volume of some or all metrics.

Possible Cause: Splunk Configuration

The data volume dashboard queries Splunk's _internal index which in turn reads that data from Splunk's log file metrics.log. By default Splunk only logs throughput for up to ten sourcetypes.

Resolution

Configure Splunk to log data for all sourcetypes by adding the following to $SPLUNK_HOME/etc/system/local/limits.conf:

[metrics]
maxseries = integer

Choose integer so that it is larger than the number of sourcetypes.

This configuration change is required on the indexers only.

Possible Cause: Permissions

Your user account might not have permissions for the index _internal. To check first go to Settings -> Access controls -> Users -> Your user name and note the roles assigned to you. Then go to Settings -> Access controls -> Roles and check if any of your roles has either _internal or All internal indexes in the box Selected search indexes, i.e. one of these:

Resolution

Assign either _internal or All internal indexes to Selected search indexes of one of your roles.