All Apps and Add-ons

How to get license usage data from monitoring console to searchhead?

bgagliardi1
Path Finder

I have a distributed Splunk environment and my deployment server is where my monitoring console for the environment resides.

I have a search head cluster that I'm putting a dashboard on with a variety of searches/reports/etc. I want to get the license information from the monitoring console dashboard on my dashboard on my searchheads, but the macros and such from the monitoring console app along with the data are all on my deployment server.

What's the best way to get the license information I get from this search on the deployment server over to my search head cluster?

`dmc_licensing_base_summary(deployment.company,"")` | `dmc_licensing_summery_no_split(deployment.company, dmc_licensing_stack_size_srch, deployment.company, "", "")`

I've tried using this search but the results are off by like 10-15%:

| savedsearch instrumentation.licenseUsage | spath date

0 Karma

bgagliardi1
Path Finder

I came up with my own solution but I'm open to new ideas. I added the deployment server which is also my license and monitoring console as a search peer. Then I used this command:

| rest splunk_server=deploymentserver /services/licenser/pools | search [rest splunk_server=deploymentserver /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | join type=outer stack_id [rest splunk_server=local /services/licenser/stacks | eval stack_id=title | eval stack_quota=quota | fields stack_id stack_quota] | stats sum(used_bytes) as used max(stack_quota) as total | eval usedGB=round(used/1024/1024/1024,3) | eval totalGB=round(total/1024/1024/1024,3) | eval gauge_base=0 | eval gauge_danger=totalGB*0.8 | eval gauge_top=totalGB+0.001 | gauge usedGB gauge_base gauge_danger totalGB gauge_top | eval

If you don't know the server name, you can replace deploymentserver with * and it will query all search peers. Then you could look at the fields value and see which splunk_server values are available.

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...