I have a distributed Splunk environment and my deployment server is where my monitoring console for the environment resides.
I have a search head cluster that I'm putting a dashboard on with a variety of searches/reports/etc. I want to get the license information from the monitoring console dashboard on my dashboard on my searchheads, but the macros and such from the monitoring console app along with the data are all on my deployment server.
What's the best way to get the license information I get from this search on the deployment server over to my search head cluster?
`dmc_licensing_base_summary(deployment.company,"")` | `dmc_licensing_summery_no_split(deployment.company, dmc_licensing_stack_size_srch, deployment.company, "", "")`
I've tried using this search but the results are off by like 10-15%:
| savedsearch instrumentation.licenseUsage | spath date
I came up with my own solution but I'm open to new ideas. I added the deployment server which is also my license and monitoring console as a search peer. Then I used this command:
| rest splunk_server=deploymentserver /services/licenser/pools | search [rest splunk_server=deploymentserver /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | join type=outer stack_id [rest splunk_server=local /services/licenser/stacks | eval stack_id=title | eval stack_quota=quota | fields stack_id stack_quota] | stats sum(used_bytes) as used max(stack_quota) as total | eval usedGB=round(used/1024/1024/1024,3) | eval totalGB=round(total/1024/1024/1024,3) | eval gauge_base=0 | eval gauge_danger=totalGB*0.8 | eval gauge_top=totalGB+0.001 | gauge usedGB gauge_base gauge_danger totalGB gauge_top | eval
If you don't know the server name, you can replace deploymentserver with * and it will query all search peers. Then you could look at the fields value and see which splunk_server values are available.