Alerts: Assistance in showing servers logging the most when license quota is at 75% full

Path Finder

I am looking for help to see how i can have my current alert, which emails me that our quota is 75% full, to also present in my email the top 10 offenders of logging.

Is that possible?

Currently my search i'm using to show a 30G quota being 75% full is:

index=_internal source="license_usage.lo" type=Usage pool="Linux Pool" earliest=@d| stats sum(b) as bytes | eval gb=bytes/1024/1024/1024|where gb>=22

Is there a way on the search to also have it show the top offenders, such as

index = * | tp limit=10 host

Thank you!

Tags (1)
0 Karma

Revered Legend

Try like this

index=_internal source="license_usage.lo" type=Usage pool="Linux Pool" earliest=@d
| stats sum(b) as usageGB by h
| eval usageGB =usageGB/1024/1024/1024 
| eventstats sum(usageGB) as TotalUsage  
| sort 10 UsageGB|where TotalUsage>=22
0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...