Splunk license usage check

Project Notes

You want to keep an eye on the license usage, as 5 warnings of the daily indexing volume using the enterprise license or 3 warnings using the free license will cause a license violation.

A license violation will deactivate Splunk searches but not the indexing process. So you will not be able to query your data – but at least never loose it.

Typically the license warnings are only displayed in the web console. This check will help you to ensure proper licensing in your normal monitoring and escalation process.

Parameters:
-servername
the servername or ip address to be checked – default localhost

-port
port of splunkd – default 8089

-protocol
protocol to use to communicate with splunkd – default: https

-timeout
connectiontimeout to splunkd in milliseconds – default 5000

-username
username to use to login to splunkd

-password
password to use with splunkd

-pool
licensepool to check – default “auto_generated_pool_download-trial” ..
freeversion is “auto_generated_pool_free”
full license is “auto_generated_pool_enterpise

-warn
warningvalue in Megabytes

-critical
critical value in Megabytes

-showpool
display all pools found on the indexer and usage. Values could be 0 (default: don’t display) or 1 (display)