Hi...I wanted to know how we can create an alert when the license usage of a "heavy forwarder" reaches a threshold say about 90% of license usage. We want to get alerted when such a thing occurs. Currently I have the following search:
index =_internal source = *license_usage.log* type = Usage earliest=-7d@d latest=now | search h=ftlpsplunkfwd01.citrite.net | eval MB=b/(1024*1024) | eval date=strftime(_time, "%1m/%0d/%Y") | stats sum(MB) as Usage(MB) by date
↧