Splunk Search

How to create a conditional search if license usage is above 80%, then show top 10 hosts?

fli
Explorer

There is default license alert when license usage is greater 80%, then you will get email notification. The alert is like

" | rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval quota=if(isnull(effective_quota),quota,effective_quota) | eval "% used"=round(used_bytes/quota*100,2) | fields Pool "% used" | where '% used' > 80 "

Is there possible to create another alert that if the license usage is greater 80%, then sent the alert along with the top 10 usage hosts?

it's like the conditional search.

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

| rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval quota=if(isnull(effective_quota),quota,effective_quota) | eval "% used"=round(used_bytes/quota*100,2) | fields Pool "% used" | where '% used' > 80 | map search="search index=_internal sourcetype=splunkd source=*license_usage.log type=Usage earliest=@d | stats sum(b) as usage by h | eval usage=round(usage/1024/1024/1024,3) | sort 10 -usage"

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try

| rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval quota=if(isnull(effective_quota),quota,effective_quota) | eval "% used"=round(used_bytes/quota*100,2) | fields Pool "% used" | where '% used' > 80 | map search="search index=_internal sourcetype=splunkd source=*license_usage.log type=Usage earliest=@d | stats sum(b) as usage by h | eval usage=round(usage/1024/1024/1024,3) | sort 10 -usage"
0 Karma

fli
Explorer

thanks somesoni2, it works!!

0 Karma

DalJeanis
Legend

@somesoni2 - I'm thinking that the original search could result in multiple records (one for each licenser pool above 80% usage with an active stack_id). Any way to pull top 10 usage hosts in each Pool?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...