Deployment Architecture

How to access POOL_SIZE from non-license master?

a212830
Champion

Hi,

I had some license reports running on our license manager, and now I've been asked to put them on the customer search heads. The reports work fine except that the pool_size overlay doesn't display and isn't available. I'm assuming that's because these search heads aren't the license manager. Is there a way to access the pool_size from the search heads?

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Make sure the License Server is forwarding all data (not indexing and forward, just forward) to the indexers (that the Search Heads are searching). Make sure the License Server is set up as a Search Head of said indexer Cluster (so it can search its data).

I think you already have the above like that, but unless I'm misunderstanding your ask, it should be as simple as getting the poolsz from the license_usage:

index=_internal sourcetype=splunkd source=*/license_usage.log
 | timechart span=1day latest(poolsz) AS pool_size, sum(b) AS size by pool
0 Karma

adonio
Ultra Champion

add this to your searches and use as chart overlay
| rest /services/licenser/pools
| eval quota_gb = round(effective_quota/1024/1024/1024, 2)
| table title quota_gb
hope it helps

0 Karma

somesoni2
SplunkTrust
SplunkTrust

That information comes from REST endpoint query on the license master node, so not available on search-heads. Your option would be:
1) If you want to work it as-is (same query), then you'd need to add your license master as search peer (Settings-> Distributed Search-> Search peers). A search head can query rest api endpoints from the search peers, so that query would work.
2) Setup a scheduled search on license master to log the current pool sizes (and any other information that you might be interested in) to summary index. Then you can update your dashboard/reports to use the data from summary index to get the pool size instead of REST query.

0 Karma

a212830
Champion

This, number 1 from you, along with the previous comment sound right. I do have a concern... This is using SHP, and we had issue previously where we somehow ended up counting licensing twice, and my recollection is that was this type of setup. Could that happen? It was a long time ago, and we don't have an evironment for me to easily duplicate this setup.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

As long as you're not storing the license usage data in your license master locally, along with forwarding it to your indexers (which I believe you're doing, recommended, as the other license reports works fine for you from SH), you should be fine. Again, I have this setup but we use SHC, not SHP. May be you just test this setup at some lab/lower environment before you try on your PROD.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...