How to get an alert before license is about to expire?


Dear all,

I am a user of the Splunk Developer License aka Enterprise license, time limited to 6 months.
Recently it happened that my license expires unnoticed and when I connected to the search head again a couple of days later, Splunk told me, that it had expired and I have this and that many violations because of this.

Even after applying my prolonged new dev license, I was not able to search again, because of the "5 violations in 30 days" restrictions and had to ask for a reset license, so I could use Splunk again immediately.

I now want to create a search/alert that warns me ahead of time that my license is due to expire so I can prolong it in time. However, I cannot seem to find the proper sourcetype / index, where I can find that information? I'm pretty sure that Splunk splunks these messages, that the license is about to expire in n days, doesn't it?


Labels (2)
Tags (3)
0 Karma

Re: How to warn before license is about to expire

Splunk Employee
Splunk Employee

A quick google search reveals this answer, referring to the proper REST API endpoint to retrieve and process the license expiration date.