You can modify the query here to meet your appropriate percentage requirements Daily License Usage in Percent. Then configure an alert to shoot you an email whenever your threshold is reached! Hope that helps.
Hi hagjos43 ,
Thanks for your time & information, I am using same query at present but it did not work as expected.
It just gives Licences utilization at particular time of the day & do not trigger the query.
My requirement here , query to run at every hour of the day & send email notification only if utilization reaches 80% or above.
You're on Splunk 6.2.2, why not using the DMC pre-build alert called DMC Alert - Total License Usage Near Daily Quota ?
Try this (NOTE- I modified the "Where used > 80" part):
| rest splunkserver=servername /services/licenser/pools | rename title AS Pool | search [rest splunkserver=servername /services/licenser/groups | search isactive=1 | eval stackid=stackids | fields stackid] | eval quota=if(isnull(effectivequota),quota,effectivequota) | eval "used"=round(used_bytes/quota*100,2) |where used > 80| fields "used"
Once Scheduled have it run every hour in the scheduler and alert based on the "Where used > 80" that SHOULD work for you 🙂
Created a saved search with | rest /services/licenser/usage | eval usage = slavesusagebytes/quota| fields usage | where usage >0.80