The Data Volume Dashboard Does Not Display Values For All Metrics

Symptom

The data volume dashboard only displays “N/A” for the volume of some or all metrics.

Possible Cause: Splunk Configuration

The data volume dashboard queries Splunk’s _internal index which in turn reads that data from Splunk’s log file license_usage.log. By default, every Splunk indexer periodically reports to the license manager stats of the data indexed: broken down by source, source type, host, and index. If the number of distinct (source, source type, host, index) tuples grows over the squash_threshold, Splunk squashes the {host, source} values and only reports a breakdown by {sourcetype, index}. This is to prevent high memory usage and an unwieldy number of license_usage.log lines.

Resolution

Increase the squash_threshold by adding the following to $SPLUNK_HOME/etc/system/local/server.conf:

[license]
squash_threshold = 10000

You will find more information here.

Possible Cause: Permissions

Your user account might not have permissions for the index _internal. To check first go to Settings -> Access controls -> Users -> Your user name and note the roles assigned to you. Then go to Settings -> Access controls -> Roles and check if any of your roles has either _internal or All internal indexes in the box Selected search indexes, i.e. one of these:

Resolution

Assign either _internal or All internal indexes to Selected search indexes of one of your roles.