Here is the underlying SPL of the license server panel:
| rest splunk_server=local /services/licenser/pools
| rename title AS Pool
| search [rest splunk_server=local /services/licenser/groups
| search is_active=1
| eval stack_id=stack_ids
| fields stack_id]
| join type=outer stack_id [rest splunk_server=local /services/licenser/stacks
| eval stack_id=title
| eval stack_quota=quota
| fields stack_id stack_quota]
| stats sum(used_bytes) as used max(stack_quota) as total
| eval usedGB=round(used/1024/1024/1024,3)
| eval totalGB=round(total/1024/1024/1024,3)
| eval gauge_base=0 | eval gauge_danger=totalGB*0.8
| eval gauge_top=totalGB+0.001
| gauge usedGB gauge_base gauge_danger totalGB gauge_top
I assumed that to run it remotely as such that I could change "local" to the name of my license server, but that did not seem to work. Does anyone know how to run such a query on the search head?
↧