https://community.splunk.com/t5/Alerting/How-to-create-an-alert-to-trigger-when-the-license-usage-of-a/m-p/285829#M5288 <P>I tried running the query but didn't get any statistics..!</P> Thu, 02 Jun 2016 14:12:33 GMT kiran_mh 2016-06-02T14:12:33Z https://community.splunk.com/t5/Alerting/How-to-create-an-alert-to-trigger-when-the-license-usage-of-a/m-p/285827#M5286 <P>Hi...I wanted to know how we can create an alert when the license usage of a "heavy forwarder" reaches a threshold say about 90% of license usage. We want to get alerted when such a thing occurs. Currently I have the following search: </P> <PRE><CODE>index =_internal source = *license_usage.log* type = Usage earliest=-7d@d latest=now | search h=ftlpsplunkfwd01.citrite.net | eval MB=b/(1024*1024) | eval date=strftime(_time, "%1m/%0d/%Y") | stats sum(MB) as Usage(MB) by date </CODE></PRE> Thu, 02 Jun 2016 11:32:04 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-alert-to-trigger-when-the-license-usage-of-a/m-p/285827#M5286 kiran_mh 2016-06-02T11:32:04Z https://community.splunk.com/t5/Alerting/How-to-create-an-alert-to-trigger-when-the-license-usage-of-a/m-p/285828#M5287 <P>Maybe something like this:</P> <PRE><CODE>index=_internal source=*license_usage.log type=Usage earliest=-7d@d latest=now | search h=ftlpsplunkfwd01.citrite.net | eval MB=b/(1024*1024) | eval date=strftime(_time, "%1m/%0d/%Y") | stats sum(MB) as Usage(MB) by date | appendcols [ | rest splunk_server=local /services/licenser/stacks | stats max(quota) as license_limit | eval license_limitMB = license_limit/1024/1024 | fields license_limitMB ] | eventstats max(license_limitMB) as license_limitMB | eval license_usage = round('Usage(MB)'/license_limitMB*100, 2) | where license_usage &gt; 90 </CODE></PRE> Thu, 02 Jun 2016 13:22:40 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-alert-to-trigger-when-the-license-usage-of-a/m-p/285828#M5287 javiergn 2016-06-02T13:22:40Z https://community.splunk.com/t5/Alerting/How-to-create-an-alert-to-trigger-when-the-license-usage-of-a/m-p/285829#M5288 <P>I tried running the query but didn't get any statistics..!</P> Thu, 02 Jun 2016 14:12:33 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-alert-to-trigger-when-the-license-usage-of-a/m-p/285829#M5288 kiran_mh 2016-06-02T14:12:33Z https://community.splunk.com/t5/Alerting/How-to-create-an-alert-to-trigger-when-the-license-usage-of-a/m-p/285830#M5289 <P>Keep in mind the last line is filtering where license usage &gt; 90% so try tweaking that.<BR /> If that doesn't give you any result, try removing the second line (search h=...) and the earliest and latest filters.</P> Thu, 02 Jun 2016 14:27:24 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-alert-to-trigger-when-the-license-usage-of-a/m-p/285830#M5289 javiergn 2016-06-02T14:27:24Z https://community.splunk.com/t5/Alerting/How-to-create-an-alert-to-trigger-when-the-license-usage-of-a/m-p/285831#M5290 <P>Not getting a result could be good thing. The denotes that your HF is not exceeding the 90% of total license usage. TO double check the values, just remove the last line and validate the results.</P> Thu, 02 Jun 2016 19:46:51 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-alert-to-trigger-when-the-license-usage-of-a/m-p/285831#M5290 somesoni2 2016-06-02T19:46:51Z https://community.splunk.com/t5/Alerting/How-to-create-an-alert-to-trigger-when-the-license-usage-of-a/m-p/581749#M13396 <P>Sir, is there a way (SPL) to be notified when data sent by a HF changes / degrades to for example 15-20 % of the daily sent amount ? Thank u very much.</P> Wed, 19 Jan 2022 21:18:10 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-alert-to-trigger-when-the-license-usage-of-a/m-p/581749#M13396 SamHTexas 2022-01-19T21:18:10Z