Alert when license consumption reaches 1TB

[oliverrojo]

Hi,

What will be my search params if i want an alert when my license consumption reaches 1TB.

Thanks!

Oliver

[richgalloway]

What have you tried so far?

[oliverrojo]

hi @richgalloway ,

I'm using below 

index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 |timechart span=1d sum(GB) as "Total GB Used for Today"| fields - bytes  

It's shows today's consumption of 400GB but when i try below, it's no longer showing anything.

index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 |timechart span=1d sum(GB) as "Total GB Used for Today"| fields - bytes | where GB > 200

[richgalloway]

The where clause fails because the query no longer has a GB field.  The timestamp command is a transforming command that returns only the fields in its arguments plus _time.  Try this:

index=_internal source=*license_usage.log type=Usage 
| eval GB=b/1024/1024/1024 
|timechart span=1d sum(GB) as "Total GB Used for Today"
| fields - bytes 
| where 'Total GB Used for Today' > 200

[oliverrojo]

@richgalloway that also worked! Thanks a lot!

Oliver

[richgalloway]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

[aasabatini · Accepted solution]

Hi @oliverrojo 

What you mean?

for example this search check when the license it's over 1000GB in the last 30 day 

index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d   | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | timechart span=1d sum(b) AS "volume" fixedrange=false | join type=outer _time [search index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(stacksz) AS "stack size" by _time] | fields - _timediff  | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] 
| where volume > 1000

and you can add an action on this search.

script ( stop the forwarder sending)

mail (advise a license violation)

if  I don't understand the point please explain better.

Regards

Alessandro

[oliverrojo]

hi, @aasabatini ,

Using below search params, it shows my license consumption of the day = 450GB under "Total GB Used for Today" column.

index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 |timechart span=1d sum(GB) as "Total GB Used for Today"| fields - bytes 

But my objective is to only alert me if "Total GB Used for Today" shows 1000 (1TB) or greater so i used below just to test if that 450GB will still show but no output.

index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 |timechart span=1d sum(GB) as "Total GB Used for Today"| fields - bytes | where GB > 200

[aasabatini]

Hi @oliverrojo 

I think the best way to set an alert is use this search based on your search:

index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 |stats sum(GB) as "GB"| fields - bytes | where GB > 1000 | rename GB as "Total GB Used for Today"

and set the timerange on today

hope can help

Alessandro

[oliverrojo]

@aasabatini that worked! 

Thank you very much!

Oliver