We are using splunk 6.2 and I wanted to set up the alert once License usage has crossed 80%. So I have referred to this page from Splunk documentation.
Below is my search and is working in search, but if set up the alert in real-time (per result), I am not receiving the alert and it is not listing in triggered alerts. Not sure what the issue is with the search below. Please help me here.
| rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval quota=if(isnull(effective_quota),quota,effective_quota) | eval "% used"=round(used_bytes/quota*100,2) | fields Pool "% used" | where '% used' > 80
It should work if its working in search ,
your alert conditions are they set as - Trigger Condition: Number of Results is > 0
I have set up in real time search (per result). Even it is not showing in triggered alert also. not sure why it is..
If I set up this alert in real time, it is not working as expected. If I set up as Scheduled then it working fine. I have configured in Cron Schedule and it is good now.
Good to know it works for you as scheduled alert. I will try real time as well at my end.