There is default license alert when license usage is greater 80%, then you will get email notification. The alert is like
" | rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval quota=if(isnull(effective_quota),quota,effective_quota) | eval "% used"=round(used_bytes/quota*100,2) | fields Pool "% used" | where '% used' > 80 "
Is there possible to create another alert that if the license usage is greater 80%, then sent the alert along with the top 10 usage hosts?
it's like the conditional search.
Give this a try
| rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval quota=if(isnull(effective_quota),quota,effective_quota) | eval "% used"=round(used_bytes/quota*100,2) | fields Pool "% used" | where '% used' > 80 | map search="search index=_internal sourcetype=splunkd source=*license_usage.log type=Usage earliest=@d | stats sum(b) as usage by h | eval usage=round(usage/1024/1024/1024,3) | sort 10 -usage"
Give this a try
| rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval quota=if(isnull(effective_quota),quota,effective_quota) | eval "% used"=round(used_bytes/quota*100,2) | fields Pool "% used" | where '% used' > 80 | map search="search index=_internal sourcetype=splunkd source=*license_usage.log type=Usage earliest=@d | stats sum(b) as usage by h | eval usage=round(usage/1024/1024/1024,3) | sort 10 -usage"
thanks somesoni2, it works!!
@somesoni2 - I'm thinking that the original search could result in multiple records (one for each licenser pool above 80% usage with an active stack_id). Any way to pull top 10 usage hosts in each Pool?