This will give you most of what you're looking for -
./splunk show license
On my test Splunk instance, this returns:
Your session is invalid. Please login.
Splunk username: admin
Password:
Current Daily Usage Amount: 0
Expiration date: 2010-04-22T14:42:04-0700
Expiration State: 7
License level: 100 MB
Product: Enterprise
License violations:
2010-04-20T07:22:20-0700 License violation #5
2010-04-20T00:06:36-0700 License violation #4
2010-04-19T00:00:56-0700 License violation #3
2010-04-18T00:03:50-0700 License violation #2
2010-04-17T00:03:20-0700 License violation #1
Max Violations: 5
Peak usage: 1563 MB
Days remaining: 2 day(s)
Violation Period: 30
There are new ways you can alert based on violations: Community:TroubleshootingIndexedDataVolume
Yeah, what gives with removing this command? I had a nice shell script setup to alert us via email of violations, and being clear of violations - and it was based on the results of the "Show license" command. There doesn't seem to be an equivalent.
Is there a log file to which violations are logged?
4.2 update...
[root@funkytown ~]# /opt/splunk/bin/splunk version
Splunk 4.2.1 (build 98164)
[root@funkytown ~]# /opt/splunk/bin/splunk show license
This command is deprecated.
[root@funkytown ~]#
Since this question has been answered already, I guess, you'd better place that comment/answer in a new thread. Maybe someone has a solution!
This will give you most of what you're looking for -
./splunk show license
On my test Splunk instance, this returns:
Your session is invalid. Please login.
Splunk username: admin
Password:
Current Daily Usage Amount: 0
Expiration date: 2010-04-22T14:42:04-0700
Expiration State: 7
License level: 100 MB
Product: Enterprise
License violations:
2010-04-20T07:22:20-0700 License violation #5
2010-04-20T00:06:36-0700 License violation #4
2010-04-19T00:00:56-0700 License violation #3
2010-04-18T00:03:50-0700 License violation #2
2010-04-17T00:03:20-0700 License violation #1
Max Violations: 5
Peak usage: 1563 MB
Days remaining: 2 day(s)
Violation Period: 30
New command is splunk list licenses
Doesn't work with Splunk 4.2.1
This is cool, if only I ever knew!