topic Re: Splunk Cloud Built-in License Alert broken in Deployment Architecture

Splunk Cloud Built-in License Alert broken

michael_bates_1 — Tue, 29 Sep 2020 14:30:54 GMT

I am working on a Splunk Cloud deployment and have attempted to enable the built-in (splunk_instance_monitoring) alerts for license violations.

I have stripped away the bulk of the alert search to locate the broken component and it at the very front

| rest splunk_server_group=sim_group_license_master /services/licenser/pools

It appears that there is no such group as sim_group_license_master or at the least, it returns no data.

I have also attempted the License Monitor app off splunkbase and this uses the same rest endpoint.

How do I get this alert to work.
And no, I am aware of searching the _internal for license events, the problem is Splunk have provided broken functionality.

Any help appreciated.

Re: Splunk Cloud Built-in License Alert broken

woodcock — Fri, 16 Jun 2017 15:04:40 GMT

Open a support case; this is clearly a bug.

Re: Splunk Cloud Built-in License Alert broken

ytenenbaum_splu — Tue, 29 Sep 2020 14:46:09 GMT

The /services/licenser/pools API endpoint is there in order to access the licenser pools configuration and in Splunk Cloud we do not support license pools as described here: https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Service/SplunkCloudservice (" License pooling: You cannot use license pooling in Splunk Cloud").
To alert on license usage in Splunk Cloud use index=_internal source=license_usage.log type="RolloverSummary" etc...

Re: Splunk Cloud Built-in License Alert broken

ytenenbaum_splu — Thu, 09 Nov 2017 18:50:14 GMT

These alerts are now removed in version 7.0.1 which will be released in the future