Can the "Today's License Usage (GB)" panel from license server "Settings » Licensing » License Usage Reporting" be modified to run on a search head?

[lycollicott]

Here is the underlying SPL of the license server panel:

| rest splunk_server=local /services/licenser/pools 
| rename title AS Pool 
| search [rest splunk_server=local /services/licenser/groups 
| search is_active=1 
| eval stack_id=stack_ids 
| fields stack_id]
| join type=outer stack_id [rest splunk_server=local /services/licenser/stacks 
| eval stack_id=title 
| eval stack_quota=quota 
| fields stack_id stack_quota] 
| stats sum(used_bytes) as used max(stack_quota) as total 
| eval usedGB=round(used/1024/1024/1024,3) 
| eval totalGB=round(total/1024/1024/1024,3) 
| eval gauge_base=0 | eval gauge_danger=totalGB*0.8 
| eval gauge_top=totalGB+0.001 
| gauge usedGB gauge_base gauge_danger totalGB gauge_top

I assumed that to run it remotely as such that I could change "local" to the name of my license server, but that did not seem to work. Does anyone know how to run such a query on the search head?

[bmacias84]

@lycollicott, What you did will work but only if your License Master is a search peer of your search head.

Why configure your no configure your License Master as a DMC.

[somesoni2]

Try adding the deployment server as Search Peer (Setting -> Distributed search -> Search peer) on your Search Head and then you should be able to run the Rest command on the remote server (by passing teh server name).

[javiergn · Accepted solution]

Take a look at the distributed management console: http://docs.splunk.com/Documentation/Splunk/6.3.2/DMC/DMCoverview

It's got license reports (amongst other things) so you should be able to run it from your search head if you configure it accordingly.

[s2_splunk]

We recommend not running the DMC on a search head. Please review the relevant documentation on how to properly setup the DMC in your specific environment.

[lycollicott]

I stood up a dedicated DMC instance moments ago. 😉