https://community.splunk.com/t5/Splunk-Search/Have-an-alert-where-there-is-violation-of-license-and-a-search/m-p/291896#M88168 <P>After rigorously finding any help, created separate alert where if there is violation of license send me an alert along with top 10 consumers of license.</P> <P>If anybody wants to know let me know about it.</P> Sat, 10 Feb 2018 10:50:56 GMT sarwshai 2018-02-10T10:50:56Z https://community.splunk.com/t5/Splunk-Search/Have-an-alert-where-there-is-violation-of-license-and-a-search/m-p/291893#M88165 <P>Have an alert where there is violation of license and a search where top 10 consumers of license, how do i combine both , where if there is a violation of license send me alert with top consumers? Is it possible?</P> Tue, 09 Jan 2018 15:49:13 GMT https://community.splunk.com/t5/Splunk-Search/Have-an-alert-where-there-is-violation-of-license-and-a-search/m-p/291893#M88165 sarwshai 2018-01-09T15:49:13Z https://community.splunk.com/t5/Splunk-Search/Have-an-alert-where-there-is-violation-of-license-and-a-search/m-p/291894#M88166 <P>I don't know if this will answer your question directly, but I made a custom dashboard to divvy up my usage so that I can narrow down what index or sourcetype is a problem. I can then search by that sourcetype and see who the offending host might be. </P> <P>That said, paste this into a new dashboard "source" edit. </P> <PRE><CODE>&lt;form&gt; &lt;label&gt;Splunk License Usage&lt;/label&gt; &lt;fieldset submitButton="true" autoRun="true"&gt; &lt;input type="time" token="dashboard_time" searchWhenChanged="true"&gt; &lt;label&gt;&lt;/label&gt; &lt;default&gt; &lt;earliest&gt;-2d@d&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/default&gt; &lt;/input&gt; &lt;/fieldset&gt; &lt;row&gt; &lt;panel&gt; &lt;chart&gt; &lt;title&gt;Usage by Day&lt;/title&gt; &lt;search&gt; &lt;query&gt;index=_internal sourcetype=splunkd source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | timechart span=1d@d sum(GB) as Gigabytes&lt;/query&gt; &lt;earliest&gt;$dashboard_time.earliest$&lt;/earliest&gt; &lt;latest&gt;$dashboard_time.latest$&lt;/latest&gt; &lt;/search&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.overflowMode"&gt;ellipsisNone&lt;/option&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.rotation"&gt;0&lt;/option&gt; &lt;option name="charting.axisTitleX.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY2.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisX.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY2.enabled"&gt;0&lt;/option&gt; &lt;option name="charting.axisY2.scale"&gt;inherit&lt;/option&gt; &lt;option name="charting.chart"&gt;bar&lt;/option&gt; &lt;option name="charting.chart.nullValueMode"&gt;gaps&lt;/option&gt; &lt;option name="charting.chart.sliceCollapsingThreshold"&gt;0.01&lt;/option&gt; &lt;option name="charting.chart.stackMode"&gt;stacked&lt;/option&gt; &lt;option name="charting.chart.style"&gt;shiny&lt;/option&gt; &lt;option name="charting.drilldown"&gt;all&lt;/option&gt; &lt;option name="charting.layout.splitSeries"&gt;0&lt;/option&gt; &lt;option name="charting.legend.labelStyle.overflowMode"&gt;ellipsisMiddle&lt;/option&gt; &lt;option name="charting.legend.placement"&gt;right&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;option name="height"&gt;600&lt;/option&gt; &lt;/chart&gt; &lt;/panel&gt; &lt;panel&gt; &lt;chart&gt; &lt;title&gt;Usage by Index&lt;/title&gt; &lt;search&gt; &lt;query&gt;index=_internal sourcetype=splunkd source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | timechart span=1d eval(round(sum(GB),2)) as Gigabytes by idx useother=f limit=15&lt;/query&gt; &lt;earliest&gt;$dashboard_time.earliest$&lt;/earliest&gt; &lt;latest&gt;$dashboard_time.latest$&lt;/latest&gt; &lt;/search&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.overflowMode"&gt;ellipsisNone&lt;/option&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.rotation"&gt;0&lt;/option&gt; &lt;option name="charting.axisTitleX.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY.text"&gt;GB&lt;/option&gt; &lt;option name="charting.axisTitleY.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY2.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisX.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY2.enabled"&gt;0&lt;/option&gt; &lt;option name="charting.axisY2.scale"&gt;inherit&lt;/option&gt; &lt;option name="charting.chart"&gt;bar&lt;/option&gt; &lt;option name="charting.chart.nullValueMode"&gt;gaps&lt;/option&gt; &lt;option name="charting.chart.sliceCollapsingThreshold"&gt;0.01&lt;/option&gt; &lt;option name="charting.chart.stackMode"&gt;stacked&lt;/option&gt; &lt;option name="charting.chart.style"&gt;shiny&lt;/option&gt; &lt;option name="charting.drilldown"&gt;all&lt;/option&gt; &lt;option name="charting.layout.splitSeries"&gt;0&lt;/option&gt; &lt;option name="charting.legend.labelStyle.overflowMode"&gt;ellipsisEnd&lt;/option&gt; &lt;option name="charting.legend.placement"&gt;bottom&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;option name="height"&gt;600&lt;/option&gt; &lt;/chart&gt; &lt;/panel&gt; &lt;panel&gt; &lt;chart&gt; &lt;title&gt;Usage by Sourcetype&lt;/title&gt; &lt;search&gt; &lt;query&gt;index=_internal sourcetype=splunkd source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | timechart span=1d eval(round(sum(GB),2)) as Gigabytes by st useother=f limit=15&lt;/query&gt; &lt;earliest&gt;$dashboard_time.earliest$&lt;/earliest&gt; &lt;latest&gt;$dashboard_time.latest$&lt;/latest&gt; &lt;/search&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.overflowMode"&gt;ellipsisNone&lt;/option&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.rotation"&gt;0&lt;/option&gt; &lt;option name="charting.axisTitleX.text"&gt;Date&lt;/option&gt; &lt;option name="charting.axisTitleX.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY.text"&gt;GB&lt;/option&gt; &lt;option name="charting.axisTitleY.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY2.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisX.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY2.enabled"&gt;0&lt;/option&gt; &lt;option name="charting.axisY2.scale"&gt;inherit&lt;/option&gt; &lt;option name="charting.chart"&gt;bar&lt;/option&gt; &lt;option name="charting.chart.nullValueMode"&gt;gaps&lt;/option&gt; &lt;option name="charting.chart.sliceCollapsingThreshold"&gt;0.01&lt;/option&gt; &lt;option name="charting.chart.stackMode"&gt;stacked&lt;/option&gt; &lt;option name="charting.chart.style"&gt;shiny&lt;/option&gt; &lt;option name="charting.drilldown"&gt;all&lt;/option&gt; &lt;option name="charting.layout.splitSeries"&gt;0&lt;/option&gt; &lt;option name="charting.legend.labelStyle.overflowMode"&gt;ellipsisEnd&lt;/option&gt; &lt;option name="charting.legend.placement"&gt;bottom&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;option name="height"&gt;600&lt;/option&gt; &lt;/chart&gt; &lt;/panel&gt; &lt;/row&gt; &lt;row&gt; &lt;panel&gt; &lt;chart&gt; &lt;title&gt;Todays Usage, Hour&lt;/title&gt; &lt;search&gt; &lt;query&gt;index=_internal sourcetype=splunkd source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | timechart span=1h eval(round(sum(GB),2)) as Gigabytes by st useother=f limit=15&lt;/query&gt; &lt;earliest&gt;@d&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/search&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.overflowMode"&gt;ellipsisNone&lt;/option&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.rotation"&gt;0&lt;/option&gt; &lt;option name="charting.axisTitleX.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY2.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisX.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY2.enabled"&gt;0&lt;/option&gt; &lt;option name="charting.axisY2.scale"&gt;inherit&lt;/option&gt; &lt;option name="charting.chart"&gt;bar&lt;/option&gt; &lt;option name="charting.chart.bubbleMaximumSize"&gt;50&lt;/option&gt; &lt;option name="charting.chart.bubbleMinimumSize"&gt;10&lt;/option&gt; &lt;option name="charting.chart.bubbleSizeBy"&gt;area&lt;/option&gt; &lt;option name="charting.chart.nullValueMode"&gt;gaps&lt;/option&gt; &lt;option name="charting.chart.showDataLabels"&gt;none&lt;/option&gt; &lt;option name="charting.chart.sliceCollapsingThreshold"&gt;0.01&lt;/option&gt; &lt;option name="charting.chart.stackMode"&gt;stacked&lt;/option&gt; &lt;option name="charting.chart.style"&gt;shiny&lt;/option&gt; &lt;option name="charting.drilldown"&gt;all&lt;/option&gt; &lt;option name="charting.layout.splitSeries"&gt;0&lt;/option&gt; &lt;option name="charting.layout.splitSeries.allowIndependentYRanges"&gt;0&lt;/option&gt; &lt;option name="charting.legend.labelStyle.overflowMode"&gt;ellipsisMiddle&lt;/option&gt; &lt;option name="charting.legend.placement"&gt;right&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;option name="height"&gt;600&lt;/option&gt; &lt;/chart&gt; &lt;/panel&gt; &lt;panel&gt; &lt;chart&gt; &lt;title&gt;Todays Daily Usage Alarm&lt;/title&gt; &lt;search&gt; &lt;query&gt;index=_internal sourcetype=splunkd source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | stats sum(GB)&lt;/query&gt; &lt;earliest&gt;@d&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/search&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.overflowMode"&gt;ellipsisNone&lt;/option&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.rotation"&gt;0&lt;/option&gt; &lt;option name="charting.axisTitleX.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY2.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisX.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY2.enabled"&gt;0&lt;/option&gt; &lt;option name="charting.axisY2.scale"&gt;inherit&lt;/option&gt; &lt;option name="charting.chart"&gt;radialGauge&lt;/option&gt; &lt;option name="charting.chart.bubbleMaximumSize"&gt;50&lt;/option&gt; &lt;option name="charting.chart.bubbleMinimumSize"&gt;10&lt;/option&gt; &lt;option name="charting.chart.bubbleSizeBy"&gt;area&lt;/option&gt; &lt;option name="charting.chart.nullValueMode"&gt;gaps&lt;/option&gt; &lt;option name="charting.chart.rangeValues"&gt;[0,70,85,90]&lt;/option&gt; &lt;option name="charting.chart.showDataLabels"&gt;none&lt;/option&gt; &lt;option name="charting.chart.sliceCollapsingThreshold"&gt;0.01&lt;/option&gt; &lt;option name="charting.chart.stackMode"&gt;default&lt;/option&gt; &lt;option name="charting.chart.style"&gt;shiny&lt;/option&gt; &lt;option name="charting.drilldown"&gt;all&lt;/option&gt; &lt;option name="charting.gaugeColors"&gt;[0x84E900,0xFFE800,0xBF3030]&lt;/option&gt; &lt;option name="charting.layout.splitSeries"&gt;0&lt;/option&gt; &lt;option name="charting.layout.splitSeries.allowIndependentYRanges"&gt;0&lt;/option&gt; &lt;option name="charting.legend.labelStyle.overflowMode"&gt;ellipsisMiddle&lt;/option&gt; &lt;option name="charting.legend.placement"&gt;right&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;option name="height"&gt;400&lt;/option&gt; &lt;/chart&gt; &lt;/panel&gt; &lt;/row&gt; &lt;/form&gt; </CODE></PRE> Tue, 09 Jan 2018 19:18:15 GMT https://community.splunk.com/t5/Splunk-Search/Have-an-alert-where-there-is-violation-of-license-and-a-search/m-p/291894#M88166 JDukeSplunk 2018-01-09T19:18:15Z https://community.splunk.com/t5/Splunk-Search/Have-an-alert-where-there-is-violation-of-license-and-a-search/m-p/291895#M88167 <P>Thanks it's very helpful, but i want usage by hosts too, i'll see that try to do it on my own.<BR /> But precisely wanted an alert where for e.g. my license of 100 GB exceeds and i get an violation alert along with top 10-15 consumers by host.<BR /> Thanks any way!</P> Wed, 10 Jan 2018 07:54:11 GMT https://community.splunk.com/t5/Splunk-Search/Have-an-alert-where-there-is-violation-of-license-and-a-search/m-p/291895#M88167 sarwshai 2018-01-10T07:54:11Z https://community.splunk.com/t5/Splunk-Search/Have-an-alert-where-there-is-violation-of-license-and-a-search/m-p/291896#M88168 <P>After rigorously finding any help, created separate alert where if there is violation of license send me an alert along with top 10 consumers of license.</P> <P>If anybody wants to know let me know about it.</P> Sat, 10 Feb 2018 10:50:56 GMT https://community.splunk.com/t5/Splunk-Search/Have-an-alert-where-there-is-violation-of-license-and-a-search/m-p/291896#M88168 sarwshai 2018-02-10T10:50:56Z