How to create a conditional search if license usage is above 80%, then show top 10 hosts?

[fli]

There is default license alert when license usage is greater 80%, then you will get email notification. The alert is like

" | rest splunkserver=local /services/licenser/pools | rename title AS Pool | search [rest splunkserver=local /services/licenser/groups | search isactive=1 | eval stackid=stackids | fields stackid] | eval quota=if(isnull(effectivequota),quota,effectivequota) | eval "% used"=round(used_bytes/quota*100,2) | fields Pool "% used" | where '% used' > 80 "

Is there possible to create another alert that if the license usage is greater 80%, then sent the alert along with the top 10 usage hosts?

it's like the conditional search.

[somesoni2 · Accepted solution]

Give this a try

| rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval quota=if(isnull(effective_quota),quota,effective_quota) | eval "% used"=round(used_bytes/quota*100,2) | fields Pool "% used" | where '% used' > 80 | map search="search index=_internal sourcetype=splunkd source=*license_usage.log type=Usage earliest=@d | stats sum(b) as usage by h | eval usage=round(usage/1024/1024/1024,3) | sort 10 -usage"

[fli]

thanks somesoni2, it works!!

[DalJeanis]

@somesoni2 - I'm thinking that the original search could result in multiple records (one for each licenser pool above 80% usage with an active stack_id). Any way to pull top 10 usage hosts in each Pool?