Security

Can I email a licensing alert before it becomes a violation

BobM
Builder

With the latest versions of splunk we have licensing alerts that warn you are approaching a licensing limit and advising you to correct it before midnight but you need to be logged on to see them. Is there a way of making these alerts email me so I have a chance to do this before I get the violation?

I have seen plenty of searches for violations and have seen a search in the Deployment Monitor app for throughput volumes per pool but none that can compare this with the current pool size and alert if it is approaching or over.

hartfoml
Motivator

I have the Search code you need here.
link text

I am still waiting for one peace of help on this.

Read my post to get the code

0 Karma

BobM
Builder

Thanks but it isn't quite what I wanted.

Your search finds data indexed for the day but doesn't compare this to the license pools. I want something dynamic I can put on multiple servers without having to check which pool they are in and what size it is.

PS I answered the date problem.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...