How to access POOL_SIZE from non-license master?

[a212830]

Hi,

I had some license reports running on our license manager, and now I've been asked to put them on the customer search heads. The reports work fine except that the pool_size overlay doesn't display and isn't available. I'm assuming that's because these search heads aren't the license manager. Is there a way to access the pool_size from the search heads?

[sloshburch]

Make sure the License Server is forwarding all data (not indexing and forward, just forward) to the indexers (that the Search Heads are searching). Make sure the License Server is set up as a Search Head of said indexer Cluster (so it can search its data).

I think you already have the above like that, but unless I'm misunderstanding your ask, it should be as simple as getting the poolsz from the license_usage:

index=_internal sourcetype=splunkd source=*/license_usage.log
 | timechart span=1day latest(poolsz) AS pool_size, sum(b) AS size by pool

[adonio]

add this to your searches and use as chart overlay
| rest /services/licenser/pools
| eval quota_gb = round(effective_quota/1024/1024/1024, 2)
| table title quota_gb
hope it helps

[somesoni2]

That information comes from REST endpoint query on the license master node, so not available on search-heads. Your option would be:
1) If you want to work it as-is (same query), then you'd need to add your license master as search peer (Settings-> Distributed Search-> Search peers). A search head can query rest api endpoints from the search peers, so that query would work.
2) Setup a scheduled search on license master to log the current pool sizes (and any other information that you might be interested in) to summary index. Then you can update your dashboard/reports to use the data from summary index to get the pool size instead of REST query.

[a212830]

This, number 1 from you, along with the previous comment sound right. I do have a concern... This is using SHP, and we had issue previously where we somehow ended up counting licensing twice, and my recollection is that was this type of setup. Could that happen? It was a long time ago, and we don't have an evironment for me to easily duplicate this setup.

[somesoni2]

As long as you're not storing the license usage data in your license master locally, along with forwarding it to your indexers (which I believe you're doing, recommended, as the other license reports works fine for you from SH), you should be fine. Again, I have this setup but we use SHC, not SHP. May be you just test this setup at some lab/lower environment before you try on your PROD.