Alerting

Splunk Alert when license reaches 80% of usage and is about to expire.

JuhiSaxena
Explorer

We are using following query however would want some validation on it. What should be the earliest and latest time spans?

index=_internal source=license_usage.log type=Usage earliest=-0h@d latest=now splunk_server= pool=*
| eval KB=round(b/1024) | eval MB=round(KB/1024,2) | eval GB=round(MB/1024,2) | eval TB=round(GB/1024,2)
| stats sum(MB) as TotalUsed, sum(b) as TotalBytesUsed by pool, poolsz
| eval perc = tostring(round(TotalBytesUsed/poolsz*100,4))."%"
| eval poolsz = case("MB"="TB", poolsz/1024/1024/1024/1024, "MB"="GB", poolsz/1024/1024/1024, "MB"="MB", poolsz/1024/1024, "MB"="KB", poolsz/1024)
| eval poolsz =tostring(poolsz)." MB"
| eval TotalUsed = tostring(TotalUsed)." MB"
| rename pool as "License Pool", poolsz as "Pool Size", TotalUsed as "Total Used", perc as "Percent Used" | table "License Pool" "Pool Size" "Total Used" "Percent Used"| search "Percent Used">80

Also we need to know what should be the date time range for the alert to be run [should it be all time].

Tags (1)
0 Karma

adonio
Ultra Champion

you have prebuilt alert for it in splunk
settings -> Monitoring Console -> settings (dropdown) -> Alerts Setup
enable and modify thresholds to the following:
DMC Alert - Expired and Soon To Expire Licenses
DMC Alert - Total License Usage Near Daily Quota

or copy the searches, pay attention to macros (use the job inspector to see full search)

Hope it helps

p.s. license should probably run daily or every 4 hours or so.
most of the time i have seen users alert if at mid day, they are more than 50% daily license usage.
you can apply the same principal

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...