Installation

License usage by subnet

mchandx
Path Finder

Hello,

I have a request that I cannot seem to figure out. What I need to do is monitor the license usage on a per subnet basis (ex. daily license usage for 192.168.*), then break it down to the host level. For example, lets say I have 5 hosts: 192.168.1.1, 192.168.2.4, 192.168.7.8, 192.168.42.12, 192.168.87.16. I need to have a search scan the entire 192.168.0.0/16 range, then break the report down to license usage per host. (Sorry, having a bit of a problem expressing my thoughts)

The twist is from that search, I need to set up an alert to report when a host goes over x% license usage.

I am not exactly sure how to do this. I have a search that reads total number of logs from all hosts, one that shows the top reporting hosts, and one that shows the total daily license usage.

Any advice is welcome.

Please do not reference this thread as this doesn't do what I want it to do.

Thanks in advance!

0 Karma

ziegfried
Influencer
index=_internal source=*license_usage.log type=Usage h=192.168.0.0/16 | stats sum(b) as bytes by h | eval usagePercent=bytes/( 50 *1024*1024*1024)*100 | where usagePercent>5

This search would output the hosts in the 192.168.0.0/16 range using more than 5 % of the 50 GB license for the selected time range. You'd have to customize this search (ie. change 50 to the actual licensed volume and set the threshold).

Also, this search assumes the host values in splunk to be IP addresses. You'd have to add reverse DNS resolution if this isn't the case.

index=_internal source=*license_usage.log type=Usage | lookup dnslookup clienthost as h OUTPUT clientip as ip | eval h=coalesce(ip,h) | search h=192.168.0.0/16 | stats sum(b) as bytes by h | eval usagePercent=bytes/( 50 *1024*1024*1024)*100 | where usagePercent>5
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...