Splunk Search

How to search to check license usage every hour and send an alert email every 10 mins upon reaching 80%?

Pranit_Hod
New Member

How to write a search for License usage to be checked every hour & send an alert email every 10 mins upon reaching 80%.
product Splunk enterprize 6.2.2 / Windows platform.

0 Karma

valiquet
Contributor

Created a saved search with | rest /services/licenser/usage | eval usage = slaves_usage_bytes/quota| fields usage | where usage >0.80

0 Karma

hagjos43
Contributor

You can modify the query here to meet your appropriate percentage requirements Daily License Usage in Percent. Then configure an alert to shoot you an email whenever your threshold is reached! Hope that helps.

Pranit_Hod
New Member

Hi hagjos43 ,

Thanks for your time & information, I am using same query at present but it did not work as expected.
It just gives Licences utilization at particular time of the day & do not trigger the query.

My requirement here , query to run at every hour of the day & send email notification only if utilization reaches 80% or above.

0 Karma

hagjos43
Contributor

Try this (NOTE- I modified the "Where used > 80" part):

| rest splunk_server=servername /services/licenser/pools | rename title AS Pool | search [rest splunk_server=servername /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval quota=if(isnull(effective_quota),quota,effective_quota) | eval "used"=round(used_bytes/quota*100,2) |where used > 80| fields "used"

Once Scheduled have it run every hour in the scheduler and alert based on the "Where used > 80" that SHOULD work for you 🙂

0 Karma

MuS
SplunkTrust
SplunkTrust

You're on Splunk 6.2.2, why not using the DMC pre-build alert called DMC Alert - Total License Usage Near Daily Quota ?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...