How do I alert on license violations?

Question

Is there a recommended saved search I can run on the indexer to alert me when the daily indexing volume is approaching the license limit?

Accepted Answer

4

You can try using this search to check your license violations:

index=_internal source=*license_audit.log LicenseManager-Audit | delta quotaExceededCount as quotadiff | stats first(quotadiff) as quotadiff | search quotadiff<0

see this forum thread: http://www.splunk.com/support/forum:SplunkSearchAndAlert/3680

link

answered 25 Jan '10, 23:48

benstraw
675●2●12
accept rate: 80%

edited 20 Apr '11, 09:09

hexx ♦
7.0k●1●8●34

Answer 2

4

You may want to use this query if you issue the search from a search head with several indexers:

index=_internal source=*license_audit.log LicenseManager-Audit | streamstats current=f global=f window=1 first(quotaExceededCount) as next_quotaExceededCount by host | eval quotadiff = next_quotaExceededCount - quotaExceededCount | search quotadiff>0

And there is more information about licenses here:

http://www.splunk.com/wiki/Community:TroubleshootingIndexedDataVolume

link

answered 10 Sep '10, 12:54

chris
1.1k●1●9
accept rate: 48%

1

Note: this search needs to be run over a two day period, to compare yesterday's results to today's.

(15 Feb '11, 15:53) Jason

I just set one up for earliest -2d latest now time bounds and 0 1 * * * cron schedule.

(15 Feb '11, 15:54) Jason

How do I alert on license violations?

Follow this question

Splunk Resources

Related questions