Security

License monitoring

hartfoml
Motivator

I can run this search every hour
[ index=_internal sourcetype=splunkd Metrics "group=per_host_thruput" | stats sum(kb) AS Totalkb | Eval GB=round(Totalkb/1048576,2) | TABLE GB ]

I can put a | WHERE GB > (### "warring limit")
so that an alert does not trigger unless my license is about to be violated.

The question is when the trigger is met and the alert sends a message, how do I get the present date of the alert in the (| TABLE Date$Time GB) output of the search?

this search takes about 4 seconds to run and I can run it every hour so that i am alerted early in the day if something has changed that might cause a violation in my license.

Tags (1)
0 Karma
1 Solution

BobM
Builder

You can use bucket to create a date field and then convert to format it as M/D/Y

index=_internal sourcetype=splunkd Metrics "group=per_host_thruput"| bucket _time span=1d as date| stats sum(kb) AS Totalkb by date | Eval GB=round(Totalkb/1048576,2) |convert  timeformat="%m/%d/%Y" ctime(date)  | TABLE date GB

View solution in original post

BobM
Builder

You can use bucket to create a date field and then convert to format it as M/D/Y

index=_internal sourcetype=splunkd Metrics "group=per_host_thruput"| bucket _time span=1d as date| stats sum(kb) AS Totalkb by date | Eval GB=round(Totalkb/1048576,2) |convert  timeformat="%m/%d/%Y" ctime(date)  | TABLE date GB

hartfoml
Motivator

Sorry I left out some info on this.

if I run this on this schedule */60 * * * * for h24@h then I get the total size of data captured in the last 24 hour of the report time. I could also run this on */30 * * * to narrow the time to catch a violation. since this is looking back on the past 24 hours then you catch the violations before your actual 24 hour license measurement is taken.

this is the output of the search.

GB

1 ##.##

I would like to get this output

Date GB

1 mm/dd/yy ##.##

Any suggestions would help.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...