Alerting

Custom Alert condition search to report on indexed volume

apro
Path Finder

Hi,

Have scheduled a search to report on total daily indexed volume for all our servers.

Will like to create Custom Alert condition search to specify if I only want to receive an email notification if the total indexed volume hit certain percent of the license limit? say eg. 350MB out of 500MB?80% out of 100%..

Tags (1)
1 Solution

Lowell
Super Champion

Here is an example of a search that shows percentage of license use:

index=_internal sourcetype=splunkd LicenseManager-Audit todaysBytesIndexed licenseSize | eval todayMb=(todaysBytesIndexed/1048576) | eval percentUsed=round(100*todayMb/licenseSize,2)

For the purpose of an alert, you could add a custom alerting condition with the following expressions if you only want to be notified when your usage exceeds 80%.

where percentUsed>80

View solution in original post

Lowell
Super Champion

Here is an example of a search that shows percentage of license use:

index=_internal sourcetype=splunkd LicenseManager-Audit todaysBytesIndexed licenseSize | eval todayMb=(todaysBytesIndexed/1048576) | eval percentUsed=round(100*todayMb/licenseSize,2)

For the purpose of an alert, you could add a custom alerting condition with the following expressions if you only want to be notified when your usage exceeds 80%.

where percentUsed>80

beaumaris
Communicator

This works for pre-4.2 installations, but with 4.2 and license pooling the license_audit.log file always reports 0 for all the fields. How would you structure the search on a 4.2.X system that is configured for license pooling?

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...