| rest splunk_server_group=dmc_group_license_master /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | mvexpand stack_id | join type=outer stack_id splunk_server [ rest s...
See more...
| rest splunk_server_group=dmc_group_license_master /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | mvexpand stack_id | join type=outer stack_id splunk_server [ rest splunk_server_group=dmc_group_license_master /services/licenser/pools] | fields splunk_server, stack_id, effective_quota, used_bytes | stats sum(used_bytes) as used_bytes max(effective_quota) as stack_quota by stack_id | eval usedGB=round(used_bytes/1024/1024/1024, 3),totalGB=round(stack_quota/1024/1024/1024, 3), percentage=round((used_bytes / stack_quota) * 100, 2) | eval alert_level=case(percentage >= 90, "Critical: >90%",percentage >= 80, "Warning: >80%",percentage >=70, "Info: >70%",true(), null()) | where isnotnull(alert_level) | rename stack_id AS Instance, percentage AS "License quota used (%)",usedGB AS "License quota used (GB)",totalGB AS "Total license quota (GB)",alert_level AS "Alert Level"