All Apps and Add-ons

How to automatically stop indexing on hosts when daily license limit is almost reached?

deepthi5
Path Finder

HI ,

I have a splunk enterprise license of 2GB which is crossing its daily limit frequently

I have configured an email alert when my daily index reaches 1.5GB and daily I get a report of hosts and source types which are cause for the index
so whenever I get an alert i am seeing the hosts which are indexing more and manually stopping splunkd services in that particular host but i want an automatic way which will automatically stop the services on a hosts when my license limit reaches around 1.5 GB

Can some one help

Thanks
Deepthi

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi deepthi5,

technically this is not a problem to achieve, personally I would find the reason why one host is sending more events than usually and fix that problem.

Okay, here is what you can do:

Read the docs about Access and use the CLI on a remote server and enable remote login on your universal forwarders. Create a search that returns only the host you want to stop and save it as alert which will trigger a script.

Now, here is the tricky part: Splunk will not pass the search result to this script, but you can pass either an URL or a file name where the event result is available to the alert script. So your alert script must ab able to

  1. read the host name which you want to stop
  2. be able to remote login to this host and stop Splunk via CLI command

As I said, I wouldn't do it this way ..... because, if your script or your search go crazy .. bad things could happen, like stopping the wrong host.

cheers, MuS

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can write a script that gets triggered by an Alert... SSH into the offending machine, stop the UF.

Are you indexing files? If so, stopping the UF today and starting it tomorrow would only move indexing from today to tomorrow because it'll pick up where it left off.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...