Hi...I wanted to know how we can create an alert when the license usage of a "heavy forwarder" reaches a threshold say about 90% of license usage. We want to get alerted when such a thing occurs. Currently I have the following search:
index =_internal source = *license_usage.log* type = Usage earliest=-7d@d latest=now | search h=ftlpsplunkfwd01.citrite.net | eval MB=b/(1024*1024) | eval date=strftime(_time, "%1m/%0d/%Y") | stats sum(MB) as Usage(MB) by date
Maybe something like this:
index=_internal source=*license_usage.log type=Usage earliest=-7d@d latest=now
| search h=ftlpsplunkfwd01.citrite.net
| eval MB=b/(1024*1024)
| eval date=strftime(_time, "%1m/%0d/%Y")
| stats sum(MB) as Usage(MB) by date
| appendcols [
| rest splunk_server=local /services/licenser/stacks
| stats max(quota) as license_limit
| eval license_limitMB = license_limit/1024/1024
| fields license_limitMB
]
| eventstats max(license_limitMB) as license_limitMB
| eval license_usage = round('Usage(MB)'/license_limitMB*100, 2)
| where license_usage > 90
I tried running the query but didn't get any statistics..!
Not getting a result could be good thing. The denotes that your HF is not exceeding the 90% of total license usage. TO double check the values, just remove the last line and validate the results.
Sir, is there a way (SPL) to be notified when data sent by a HF changes / degrades to for example 15-20 % of the daily sent amount ? Thank u very much.
Keep in mind the last line is filtering where license usage > 90% so try tweaking that.
If that doesn't give you any result, try removing the second line (search h=...) and the earliest and latest filters.