Monitoring Splunk

Keep track of Free Splunk 500MB limit

elliotholden
New Member

Is there a way I can keep track of the 500MB limit on the Free Splunk to where I can stop Indexing when I get close to 500MB?

0 Karma

jpolvino
Builder

I'd love to see an answer as well, since I'm running the same at home.

The hack I have so far is this, which is probably wrong:
index=_internal source="/opt/splunk/var/log/splunk/license_usage.log"
| stats sum(b) AS bSum first(poolsz) AS poolSz by idx

I imagine you can set up an alert when bSum is close to poolSz?

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...