Saved Search and alert for exceeding license?

[cpenkert]

Does anyone have a saved search that could be run daily to look at the previous 24 hour period and send an email alert if the license was exceeded for that period?

Thanks.

[lguinn2]

This should do it:

 index=_internal source="*splunkd.log" "Indexing quota exceeded"

Save the search and set an alert for results>0
Run it once a day. Normally, it runs at midnight, but you could tweak it to run at 12:05 am and look at the previous day by setting the earliest time to -1d@d and the latest to @d.

There are a number of similar questions on the forum and a nice write up in the Wiki under Troubleshooting Indexed Data Volume

Finally, there are a number of free Apps available for monitoring license usage.

[AaronMoorcroft]

Thanks for that, great help 🙂