All Apps and Add-ons

How to get license usage data from monitoring console to searchhead?

Path Finder

I have a distributed Splunk environment and my deployment server is where my monitoring console for the environment resides.

I have a search head cluster that I'm putting a dashboard on with a variety of searches/reports/etc. I want to get the license information from the monitoring console dashboard on my dashboard on my searchheads, but the macros and such from the monitoring console app along with the data are all on my deployment server.

What's the best way to get the license information I get from this search on the deployment server over to my search head cluster?

`dmclicensingbasesummary(,"")` | `dmclicensingsummerynosplit(, dmclicensingstacksize_srch,, "", "")`

I've tried using this search but the results are off by like 10-15%:

| savedsearch instrumentation.licenseUsage | spath date

0 Karma

Path Finder

I came up with my own solution but I'm open to new ideas. I added the deployment server which is also my license and monitoring console as a search peer. Then I used this command:

| rest splunkserver=deploymentserver /services/licenser/pools | search [rest splunkserver=deploymentserver /services/licenser/groups | search isactive=1 | eval stackid=stackids | fields stackid] | join type=outer stackid [rest splunkserver=local /services/licenser/stacks | eval stackid=title | eval stackquota=quota | fields stackid stackquota] | stats sum(usedbytes) as used max(stackquota) as total | eval usedGB=round(used/1024/1024/1024,3) | eval totalGB=round(total/1024/1024/1024,3) | eval gaugebase=0 | eval gaugedanger=totalGB*0.8 | eval gaugetop=totalGB+0.001 | gauge usedGB gaugebase gaugedanger totalGB gaugetop | eval

If you don't know the server name, you can replace deploymentserver with * and it will query all search peers. Then you could look at the fields value and see which splunk_server values are available.

0 Karma