Count of license usage warnings

[Knust]

Hi, I want to find out how many license warnings there is in the current 60 day rolling window. Why is there not an easy way to find this? Surely this should be included in the license usage report?

regards, Knut

[isoutamo]

Hi

you could start with license usage GUI and open that search and then modify it's earliest attribute.

At least I have this information on Settings -> License -> Usage Report -> Previous 60 days. 

Here is SPL from there

index=_internal [`set_local_host`] source=*license_usage.log* type="RolloverSummary" earliest=-60d@d   | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | timechart span=1d sum(b) AS "volume" fixedrange=false | join type=outer _time [search index=_internal [`set_local_host`] source=*license_usage.log* type="RolloverSummary" earliest=-60d@d | eval _time=_time - 43200 | bin _time span=1d | dedup _time stack | stats sum(stacksz) AS "stack size" by _time] | fields - _timediff  | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]

You must run this on node where you have your license or update that `set_local_host` part correctly. 

It seems that at least 9.1.2 this is broken. Dashboard said that it is from last 60d, but in SPL it was only last 30d!

r. Ismo

[Knust]

Thank you for the answer. I have indeed already tried the option you proposed, but believe it will not work because the default retention of the internal logs does not go past 30 days, I believe. Surely Splunk has another way to keep track of this though?

Regards, Knut

[isoutamo · Accepted solution]

There is also some summary information on _telemetry index. 

index=_telemetry licenseGroup=Enterprise component=LicenseUsageSummary

There is information for daily basis.

Another option is to extend retention time for _internal. This is the only way if you wan to see that on 60 day and select different dimensions for log usage. 

[Knust]

Yes, I think changing the retention to 60 days, or maybe even longer is the best solution for this. Lets hope they manage to fix the "Past 60 day" dashboard in the future too, for convenience.