Splunk Search
Highlighted

How to search to check license usage every hour and send an alert email every 10 mins upon reaching 80%?

New Member

How to write a search for License usage to be checked every hour & send an alert email every 10 mins upon reaching 80%.
product Splunk enterprize 6.2.2 / Windows platform.

0 Karma
Highlighted

Re: How to search to check license usage every hour and send an alert email every 10 mins upon reaching 80%?

Contributor

You can modify the query here to meet your appropriate percentage requirements Daily License Usage in Percent. Then configure an alert to shoot you an email whenever your threshold is reached! Hope that helps.

Highlighted

Re: How to search to check license usage every hour and send an alert email every 10 mins upon reaching 80%?

New Member

Hi hagjos43 ,

Thanks for your time & information, I am using same query at present but it did not work as expected.
It just gives Licences utilization at particular time of the day & do not trigger the query.

My requirement here , query to run at every hour of the day & send email notification only if utilization reaches 80% or above.

0 Karma
Highlighted

Re: How to search to check license usage every hour and send an alert email every 10 mins upon reaching 80%?

SplunkTrust
SplunkTrust

You're on Splunk 6.2.2, why not using the DMC pre-build alert called DMC Alert - Total License Usage Near Daily Quota ?

0 Karma
Highlighted

Re: How to search to check license usage every hour and send an alert email every 10 mins upon reaching 80%?

Contributor

Try this (NOTE- I modified the "Where used > 80" part):

| rest splunkserver=servername /services/licenser/pools | rename title AS Pool | search [rest splunkserver=servername /services/licenser/groups | search isactive=1 | eval stackid=stackids | fields stackid] | eval quota=if(isnull(effectivequota),quota,effectivequota) | eval "used"=round(used_bytes/quota*100,2) |where used > 80| fields "used"

Once Scheduled have it run every hour in the scheduler and alert based on the "Where used > 80" that SHOULD work for you 🙂

0 Karma
Highlighted

Re: How to search to check license usage every hour and send an alert email every 10 mins upon reaching 80%?

Contributor

Created a saved search with | rest /services/licenser/usage | eval usage = slavesusagebytes/quota| fields usage | where usage >0.80

0 Karma