Creating an alert for daily indexed volume for 4.2.x

[williamsweat]

Hello,

I want to create a saved search that will send an email with a report on daily index volumes to know when I'm close to a license violation.

I've looked at the documentation but the search given no longer works in 4.2 (and can't track the new fields yet. I'm aware of the deployment app, but I need something that will send out an email alert to a distribution list to send early warnings.

Do you have a search query available? Or know which fields in the _internal index I can use?

Thanks

[kristian_kolb]

The following search seem to work much faster, and the results are close enough - there may be some small rounding effects, but nothing significant. It's based on the searches used by the Deployment Monitor. It does not take the advanced licensing stacking, pooling etc into account. It will just give you a simple table of the amount indexed by indexer.

I did put a "where" statement in to filter out the search head itself, which also poplulates the summary index, but it's only a couple of kb, so it just clutters the report (the poster said he wanted an early warning system - not correctness down to the *n*th decimal).

index="summary_indexers" |  bucket _time as day span=d | eval gb=kb/1048576 | eval Date = strftime(day, "%b %d, %Y - %A")| stats sum(gb) as GB by my_splunk_server, Date | eval GB=round(GB,2)| where GB > "0.01" |eventstats sum(GB) as SumDailyGB by Date

This has been tested on a 1 search head - 1 indexer setup, so your results may differ.

Not sure if this would really help you, but you could always play around with it a little. Below a simpler version just giving you the basics.

index="summary_indexers" | eval GB=kb/1048576 | eval GB=round(GB,2)| timechart span=1d sum(GB) by my_splunk_server | addtotals 

Kristian

[jlaw · Accepted solution]

Here's a good Community Wiki topic with several search options:

http://www.splunk.com/wiki/Community:TroubleshootingIndexedDataVolume

And here's another Answer:

http://splunk-base.splunk.com/answers/207/how-do-i-alert-on-license-violations