Installation

How to get an alert before license is about to expire?

daubsi_2
Explorer

Dear all,

I am a user of the Splunk Developer License aka Enterprise license, time limited to 6 months.
Recently it happened that my license expires unnoticed and when I connected to the search head again a couple of days later, Splunk told me, that it had expired and I have this and that many violations because of this.

Even after applying my prolonged new dev license, I was not able to search again, because of the "5 violations in 30 days" restrictions and had to ask for a reset license, so I could use Splunk again immediately.

I now want to create a search/alert that warns me ahead of time that my license is due to expire so I can prolong it in time. However, I cannot seem to find the proper sourcetype / index, where I can find that information? I'm pretty sure that Splunk splunks these messages, that the license is about to expire in n days, doesn't it?

BR
Markus

Labels (2)
Tags (3)
0 Karma

s2_splunk
Splunk Employee
Splunk Employee

A quick google search reveals this answer, referring to the proper REST API endpoint to retrieve and process the license expiration date.

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...