How to search to check license usage every hour and send an alert email every 10 mins upon reaching 80%?

[Pranit_Hod]

How to write a search for License usage to be checked every hour & send an alert email every 10 mins upon reaching 80%.
product Splunk enterprize 6.2.2 / Windows platform.

[valiquet]

Created a saved search with | rest /services/licenser/usage | eval usage = slaves_usage_bytes/quota| fields usage | where usage >0.80

[hagjos43]

You can modify the query here to meet your appropriate percentage requirements Daily License Usage in Percent. Then configure an alert to shoot you an email whenever your threshold is reached! Hope that helps.

[Pranit_Hod]

Hi hagjos43 ,

Thanks for your time & information, I am using same query at present but it did not work as expected.
It just gives Licences utilization at particular time of the day & do not trigger the query.

My requirement here , query to run at every hour of the day & send email notification only if utilization reaches 80% or above.

[hagjos43]

Try this (NOTE- I modified the "Where used > 80" part):

| rest splunk_server=servername /services/licenser/pools | rename title AS Pool | search [rest splunk_server=servername /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval quota=if(isnull(effective_quota),quota,effective_quota) | eval "used"=round(used_bytes/quota*100,2) |where used > 80| fields "used"

Once Scheduled have it run every hour in the scheduler and alert based on the "Where used > 80" that SHOULD work for you 🙂

[MuS]

You're on Splunk 6.2.2, why not using the DMC pre-build alert called DMC Alert - Total License Usage Near Daily Quota ?