Alerting

License Master - Is there an internal query or alert to monitor the status and report when a license slave loses connection with the master for more than 1 hour?

splunker12er
Motivator

Deployment setup has a license master where all the instances are connected to master.

Recently, we had a technical issue where one of the indexers lost connection with the license master server which went unnoticed and caused problems.

Is there an internal query to monitor the status and report via email when a license slave is loses connection with the master?

0 Karma

wrangler2x
Motivator

I run this search as an alert every ten minutes which triggers and sends an email to me if the number of events is equal to zero:

index="_internal" source="/opt/splunk/var/log/splunk/license_usage.log" h="somehost.tlga.uci.edu" | stats count

It is simple and works very well. Just substitute your slave host.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi splunker12er,

you can run this search on the license master to get an overview of your license slaves:

| rest /services/licenser/slaves | table lable, updated

Based on this search you can setup an alert.
Hope this helps ...

cheers, MuS

lakromani
Builder

Does not work. wrong lable, correct label.

| rest /services/licenser/slaves | table label, updated
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi, please mark this as answered if it answers your question...you're not only helping others by marking this as answered, but you will also get some karma as well 😉

0 Karma

vcarbona
Path Finder

I don't believe this is a correct answer. In our testing, we shutoff an indexer which was reporting to our license master. It still showed a current updated time field for the shutoff indexer! Unless of course this is being read incorrectly or this rest call is not for this purpose.

From my observation, it seems the only thing to rely on is the warning_count when it comes to answering this question which may be of some value but doesn't completely answer the poster's question.

0 Karma

MuS
SplunkTrust
SplunkTrust

Thanks for this feedback! I'm currently not able to test it, but I will do it at some later stage.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...