All Apps and Add-ons

How to get license usage data from monitoring console to searchhead?

bgagliardi1
Path Finder

I have a distributed Splunk environment and my deployment server is where my monitoring console for the environment resides.

I have a search head cluster that I'm putting a dashboard on with a variety of searches/reports/etc. I want to get the license information from the monitoring console dashboard on my dashboard on my searchheads, but the macros and such from the monitoring console app along with the data are all on my deployment server.

What's the best way to get the license information I get from this search on the deployment server over to my search head cluster?

`dmc_licensing_base_summary(deployment.company,"")` | `dmc_licensing_summery_no_split(deployment.company, dmc_licensing_stack_size_srch, deployment.company, "", "")`

I've tried using this search but the results are off by like 10-15%:

| savedsearch instrumentation.licenseUsage | spath date

0 Karma

bgagliardi1
Path Finder

I came up with my own solution but I'm open to new ideas. I added the deployment server which is also my license and monitoring console as a search peer. Then I used this command:

| rest splunk_server=deploymentserver /services/licenser/pools | search [rest splunk_server=deploymentserver /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | join type=outer stack_id [rest splunk_server=local /services/licenser/stacks | eval stack_id=title | eval stack_quota=quota | fields stack_id stack_quota] | stats sum(used_bytes) as used max(stack_quota) as total | eval usedGB=round(used/1024/1024/1024,3) | eval totalGB=round(total/1024/1024/1024,3) | eval gauge_base=0 | eval gauge_danger=totalGB*0.8 | eval gauge_top=totalGB+0.001 | gauge usedGB gauge_base gauge_danger totalGB gauge_top | eval

If you don't know the server name, you can replace deploymentserver with * and it will query all search peers. Then you could look at the fields value and see which splunk_server values are available.

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...