topic Re: alert on license usage in Alerting

alert on license usage

mcbradford — Mon, 28 Sep 2020 10:12:43 GMT

I need to create an email alert when at a specified period in the day, if our license usage is > #, send an email.

So for example if at 14:00 license usage > 9000, alert

I am using the following search to get my usage.

index=_internal source=*license_usage.log earliest=@d| eval GB=b/1024/1024 | stats sum(GB) by pool | eval used='sum(GB)' | fields used

Also how do I remove the decimals?

Re: alert on license usage

lguinn2 — Fri, 09 Dec 2011 19:36:34 GMT

I did it this way:

index=_internal sourcetype=license_usage* earliest=@d | eval GB=round(b/1024/1024,0) | 
stats sum(GB) as used by pool

Not sure which version of Splunk you are using. I did this on 4.2.3

BTW, the fields command would remove the label for the pools, which would not be good if you had multiple license pools. You might also consider adding | addcoltotals to the end of command line.

Re: alert on license usage

mcbradford — Mon, 28 Sep 2020 10:12:51 GMT

This returned no results?

This is what I am using to round

Re: alert on license usage

mcbradford — Mon, 28 Sep 2020 10:12:53 GMT

I think I figured it out....

This is my search...

my custom condition is

search GB_Used_Today > 5

I plan to create and schedule probably about 4 searches throughout the day with the value "search GB_Used_Today > 5" "5" set to something different based on the time the search is run.

My goal is to identify a spike (and possible stop the spike) before it causes a license violation.

Re: alert on license usage

Damien_Dallimor — Sun, 11 Dec 2011 08:41:08 GMT

I recently answered something similar here :

http://splunk-base.splunk.com/answers/35926/email-actions-for-builtin-licensing-alerts?page=1#35938

Re: alert on license usage

amgoldschmidt — Mon, 14 Apr 2014 09:07:19 GMT

I found this for Splunk 6.0 - http://docs.splunk.com/Documentation/Splunk/6.0/Admin/LicenseUsageReportViewexamples

Re: alert on license usage

SplunkersRock — Tue, 25 Apr 2017 17:28:46 GMT

refer this
https://answers.splunk.com/answers/35926/email-actions-for-builtin-licensing-alerts.html#3593

Re: alert on license usage

dantimola — Thu, 04 Jan 2018 07:36:41 GMT

Try this:

index=_internal source=*license_usage.log* type=Usage | bucket _time span=1d | stats sum(b) as bytes by _time, pool | eval GB = round(bytes/1024/1024/1024,5) | eval quota=<your license quota here> | eval "% Used"=round(GB/quota*100,2) | rename GB as "License Util"| table "License Util" "% Used"