topic Re: Email actions for Builtin Licensing alerts in Alerting

Email actions for Builtin Licensing alerts

welkinson — Thu, 08 Dec 2011 03:51:30 GMT

Hi! Just wanted to ask does anybody know how I can set the built-in licensing alerts to send out email to me whenever it is hit? What file do I need to edit and what parameters should I add.

Thanks A lot!

Re: Email actions for Builtin Licensing alerts

Damien_Dallimor — Thu, 08 Dec 2011 07:47:45 GMT

It is simple to write your own scheduled search that fires a licensing alert.

As an example, this is a search that will fire an alert when the total daily license usage exceeds ~ 10 GB.

To target the previous calendar day , I use earliest "-1d@d" , latest "@d" , and schedule the search to run once a day at midnight.

index=_internal source=*license_usage* pool="your_license_pool" | eval GB=b/1024/1024/1024 | stats sum(GB) by pool | where 'sum(GB)' > 10

Re: Email actions for Builtin Licensing alerts

welkinson — Tue, 13 Dec 2011 23:58:04 GMT

Hi thanks for the answer, but how do I send out an email if this alert is hit? thanks

Re: Email actions for Builtin Licensing alerts

Damien_Dallimor — Wed, 14 Dec 2011 00:32:14 GMT

1) Configure your email server settings in :

Manager >> System settings >> Email alert settings

2) And then configure your scheduled search to fire an email :

Manager >> Searches and reports >> Your Search

Start time = -1d@d
End time = @d
Schedule this search = tick checkbox
Schedule type = basic
Run every = day at midnight
Condition = if custom condition is met
Custom condition search = search count > 0

In the "Alert actions" section, enable "Send Email" , and specify the email addresses to send to and a custom subject line.

Re: Email actions for Builtin Licensing alerts

agent613 — Thu, 28 Jun 2012 16:24:06 GMT

Damien's solution forces you to put an arbitrary number in the search. How can I do this and reference the pool size? I only care if the limit was exceeded and this search needs to automatically adjust if the pool size is adjisted.
Thanks.

Re: Email actions for Builtin Licensing alerts

walkeran — Tue, 07 Aug 2012 14:55:12 GMT

In >=4.3, you can use the new "index=_internal sourcetype=splunkd type=RolloverSummary" event to easily alert if the previous day had indexed more than a certain percentage of the available license pool without having to write a search that does any calculations.

Create a search that looks like:

earliest=@d latest=now sourcetype=splunkd index=_internal type=RolloverSummary | where b > poolsz*0.8

This search will yield a result if the bytes indexed are greater than 80% of the pool size. Adjust the comparison to suit your needs
Schedule it to run early in the morning, but not at midnight. This event will be inserted shortly after midnight, so schedule this to run at 1am or something
Alert if the search count returns more than zero results

Re: Email actions for Builtin Licensing alerts

walkeran — Tue, 07 Aug 2012 15:29:21 GMT

Important note! Starting in version 4.3, the search in this answer will match more events than you want it to, and essentially cause the result to be the sum of the previous two days worth of indexed data.

To keep the functionality the same, one should also add "type=Usage" to the search. The easier alternative, however, would be to use the "type=RolloverSummary" event which contains a total of the previous days usage. ( see my alternative answer to this question http://splunk-base.splunk.com/answer_link/55212/ )

Re: Email actions for Builtin Licensing alerts

agent613 — Tue, 04 Sep 2012 18:40:55 GMT

Thanks for this, walkeran. This is a much faster and more flexible solution than the previous. However, it's not totally correct. Your search will only produce results if a single indexer in the pool has exceeded the pool allocation. What is needed, is to find if all of the indexers in the pool combined have exceeded the allocation.

Here is the modified solution:

earliest=@d latest=now sourcetype=splunkd index=_internal type=RolloverSummary source=*license_usage.log |stats sum(b) as usage by pool, poolsz| where  usage > poolsz|eval usage = usage/1024/1024/1024| eval poolsz = poolsz/1024/1024/1024