How to automatically stop indexing on hosts when daily license limit is almost reached?

[deepthi5]

HI ,

I have a splunk enterprise license of 2GB which is crossing its daily limit frequently

I have configured an email alert when my daily index reaches 1.5GB and daily I get a report of hosts and source types which are cause for the index
so whenever I get an alert i am seeing the hosts which are indexing more and manually stopping splunkd services in that particular host but i want an automatic way which will automatically stop the services on a hosts when my license limit reaches around 1.5 GB

Can some one help

Thanks
Deepthi

[MuS]

Hi deepthi5,

technically this is not a problem to achieve, personally I would find the reason why one host is sending more events than usually and fix that problem.

Okay, here is what you can do:

Read the docs about Access and use the CLI on a remote server and enable remote login on your universal forwarders. Create a search that returns only the host you want to stop and save it as alert which will trigger a script.

Now, here is the tricky part: Splunk will not pass the search result to this script, but you can pass either an URL or a file name where the event result is available to the alert script. So your alert script must ab able to

1. read the host name which you want to stop
2. be able to remote login to this host and stop Splunk via CLI command

As I said, I wouldn't do it this way ..... because, if your script or your search go crazy .. bad things could happen, like stopping the wrong host.

cheers, MuS

[martin_mueller]

You can write a script that gets triggered by an Alert... SSH into the offending machine, stop the UF.

Are you indexing files? If so, stopping the UF today and starting it tomorrow would only move indexing from today to tomorrow because it'll pick up where it left off.