Alerting

How do I set up my real-time alert to trigger when license usage is greater than 80%?

Abilan1
Path Finder

Hi,

We are using splunk 6.2 and I wanted to set up the alert once License usage has crossed 80%. So I have referred to this page from Splunk documentation.

http://docs.splunk.com/Documentation/Splunk/6.0/Admin/LicenseUsageReportViewexamples

Below is my search and is working in search, but if set up the alert in real-time (per result), I am not receiving the alert and it is not listing in triggered alerts. Not sure what the issue is with the search below. Please help me here.

| rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval quota=if(isnull(effective_quota),quota,effective_quota) | eval "% used"=round(used_bytes/quota*100,2) | fields Pool "% used" | where '% used' > 80
0 Karma
1 Solution

jensonthottian
Contributor

It should work if its working in search ,
your alert conditions are they set as - Trigger Condition: Number of Results is > 0

View solution in original post

jensonthottian
Contributor

It should work if its working in search ,
your alert conditions are they set as - Trigger Condition: Number of Results is > 0

Abilan1
Path Finder

Hi,
I have set up in real time search (per result). Even it is not showing in triggered alert also. not sure why it is..

0 Karma

Abilan1
Path Finder

Hi ,

If I set up this alert in real time, it is not working as expected. If I set up as Scheduled then it working fine. I have configured in Cron Schedule and it is good now.

Thank you!!!

jensonthottian
Contributor

Good to know it works for you as scheduled alert. I will try real time as well at my end.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...