https://community.splunk.com/t5/Splunk-Search/How-to-create-a-conditional-search-if-license-usage-is-above-80/m-p/346576#M102644 <P>There is default license alert when license usage is greater 80%, then you will get email notification. The alert is like</P> <P><STRONG>" | rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval quota=if(isnull(effective_quota),quota,effective_quota) | eval "% used"=round(used_bytes/quota*100,2) | fields Pool "% used" | where '% used' &gt; 80 "</STRONG> </P> <P>Is there possible to create another alert that if the license usage is greater 80%, then sent the alert along with the top 10 usage hosts?</P> <P>it's like the conditional search. </P> Tue, 29 Sep 2020 14:27:50 GMT fli 2020-09-29T14:27:50Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-conditional-search-if-license-usage-is-above-80/m-p/346576#M102644 <P>There is default license alert when license usage is greater 80%, then you will get email notification. The alert is like</P> <P><STRONG>" | rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval quota=if(isnull(effective_quota),quota,effective_quota) | eval "% used"=round(used_bytes/quota*100,2) | fields Pool "% used" | where '% used' &gt; 80 "</STRONG> </P> <P>Is there possible to create another alert that if the license usage is greater 80%, then sent the alert along with the top 10 usage hosts?</P> <P>it's like the conditional search. </P> Tue, 29 Sep 2020 14:27:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-conditional-search-if-license-usage-is-above-80/m-p/346576#M102644 fli 2020-09-29T14:27:50Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-conditional-search-if-license-usage-is-above-80/m-p/346577#M102645 <P>Give this a try</P> <PRE><CODE>| rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval quota=if(isnull(effective_quota),quota,effective_quota) | eval "% used"=round(used_bytes/quota*100,2) | fields Pool "% used" | where '% used' &gt; 80 | map search="search index=_internal sourcetype=splunkd source=*license_usage.log type=Usage earliest=@d | stats sum(b) as usage by h | eval usage=round(usage/1024/1024/1024,3) | sort 10 -usage" </CODE></PRE> Wed, 14 Jun 2017 21:01:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-conditional-search-if-license-usage-is-above-80/m-p/346577#M102645 somesoni2 2017-06-14T21:01:32Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-conditional-search-if-license-usage-is-above-80/m-p/346578#M102646 <P>@somesoni2 - I'm thinking that the original search could result in multiple records (one for each licenser pool above 80% usage with an active stack_id). Any way to pull top 10 usage hosts in each Pool? </P> Thu, 15 Jun 2017 01:54:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-conditional-search-if-license-usage-is-above-80/m-p/346578#M102646 DalJeanis 2017-06-15T01:54:51Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-conditional-search-if-license-usage-is-above-80/m-p/346579#M102647 <P>thanks somesoni2, it works!!</P> Thu, 15 Jun 2017 13:30:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-conditional-search-if-license-usage-is-above-80/m-p/346579#M102647 fli 2017-06-15T13:30:54Z