Alerting

Is there a way to set up my Splunk cluster to alert me once I've indexed 4GB per day?

sympatiko
Communicator

Hi,

Is there a way to set my splunk cluster to alert me once I'm already indexing 4GB per day? I have a 5gb license. I just want to be alert before I exceed the allowed indexed per day.

BTW, my setup is RF=3 SF=3

Thanks,

0 Karma

linu1988
Champion

Hi Eddel,
Use the below one as an alert to get notified on your license Master.

index=_internal source=*license_usage.log type=Usage earliest=-0d@d | stats sum(b) as tot | eval GB=tot/1024/1024/1024 |table host,GB| where GB > 4

OR
Quicker

| rest /services/licenser/pools|where stack_id="enterprise" |eval used_bytes=used_bytes/(1024*1024*1024)|table splunk_server,used_bytes|where used_bytes >4|eval used_bytes=used_bytes." GB"|rename used_bytes as "Usage"

Thanks,
L

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi sympatiko,

if you're on Splunk 6.2 use the DMC (Distributed Management Console) which has predefined alerts for this. It is called DMC Alert - Total License Usage Near Daily Quota and needs to be enabled. Read more in the docs here http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Platformalerts

If you're on pre Splunk 6.2 take a look at the docs here http://docs.splunk.com/Documentation/Splunk/6.0/Admin/LicenseUsageReportViewexamples

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...