There is default license alert when license usage is greater 80%, then you will get email notification. The alert is like " | rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval quota=if(isnull(effective_quota),quota,effective_quota) | eval "% used"=round(used_bytes/quota*100,2) | fields Pool "% used" | where '% used' > 80 " Is there possible to create another alert that if the license usage is greater 80%, then sent the alert along with the top 10 usage hosts? it's like the conditional search. ... View more