Alerting

Is there a way to set up my Splunk cluster to alert me once I've indexed 4GB per day?

sympatiko
Communicator

Hi,

Is there a way to set my splunk cluster to alert me once I'm already indexing 4GB per day? I have a 5gb license. I just want to be alert before I exceed the allowed indexed per day.

BTW, my setup is RF=3 SF=3

Thanks,

0 Karma

linu1988
Champion

Hi Eddel,
Use the below one as an alert to get notified on your license Master.

index=_internal source=*license_usage.log type=Usage earliest=-0d@d | stats sum(b) as tot | eval GB=tot/1024/1024/1024 |table host,GB| where GB > 4

OR
Quicker

| rest /services/licenser/pools|where stack_id="enterprise" |eval used_bytes=used_bytes/(1024*1024*1024)|table splunk_server,used_bytes|where used_bytes >4|eval used_bytes=used_bytes." GB"|rename used_bytes as "Usage"

Thanks,
L

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi sympatiko,

if you're on Splunk 6.2 use the DMC (Distributed Management Console) which has predefined alerts for this. It is called DMC Alert - Total License Usage Near Daily Quota and needs to be enabled. Read more in the docs here http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Platformalerts

If you're on pre Splunk 6.2 take a look at the docs here http://docs.splunk.com/Documentation/Splunk/6.0/Admin/LicenseUsageReportViewexamples

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...