Alerts: Assistance in showing servers logging the most when license quota is at 75% full


I am looking for help to see how i can have my current alert, which emails me that our quota is 75% full, to also present in my email the top 10 offenders of logging.

Is that possible?

Currently my search i'm using to show a 30G quota being 75% full is:

index=_internal source="license_usage.lo" type=Usage pool="Linux Pool" earliest=@d| stats sum(b) as bytes | eval gb=bytes/1024/1024/1024|where gb>=22

Is there a way on the search to also have it show the top offenders, such as

index = * | tp limit=10 host

Thank you!

Tags (1)
0 Karma

Revered Legend

Try like this

index=_internal source="license_usage.lo" type=Usage pool="Linux Pool" earliest=@d
| stats sum(b) as usageGB by h
| eval usageGB =usageGB/1024/1024/1024 
| eventstats sum(usageGB) as TotalUsage  
| sort 10 UsageGB|where TotalUsage>=22
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!