splunk_license_alert_if_over

#!/bin/bash

#
# Jem Jensen
# May 14, 2015
#
# Splunk license usage checker
#

### CONFIG ############

USER="admin"
PASS="changeme"
SEARCH='search index=_internal source=*license_usage.log type="RolloverSummary" earliest=-1d@d   | eval _time=_time - 1440 | bin _time span=1d | stats latest(b) AS b latest(stacksz) AS stacksz by slave, pool, _time | stats sum(b) AS volumeB max(stacksz) AS stacksz by _time | eval pctused=round(volumeB/stacksz*100,0) | head 2 |table pctused'

#######################

DEBUG=false

# Handle program arguments
if [ "$1" != "" ]
then
        if [ "$1" == "-d" ]
        then
                DEBUG=true
        else
                BASE=`basename $0`
                echo "Usage: $BASE [-d]"
                echo "  d: show debugging output"
                exit
        fi
fi

# Intercept any errors that occur
function error_interceptor() {
        # If this error is a 2, display an error message and exit
        if [ "$1" == "2" ]
        then
                echo "invalid REST result"
                exit $?
        fi

        return
}

trap 'error_interceptor ${?}' ERR

function isSplunkLicenseOver() {
        if $DEBUG
        then
                echo "$SEARCH"
        fi

        # Just grab the last 2 lines to avoid the column header
        RESULTS=`curl -k -u $USER:$PASS --data-urlencode search="$SEARCH" -d "output_mode=csv" https://localhost:8089/servicesNS/admin/search/search/jobs/export 2>/dev/null`
        LINECOUNT=`echo "$RESULTS"|wc -l`
        RESULTS=`echo "$RESULTS"|tail -2`

        if $DEBUG
        then
                echo "# Results: $LINECOUNT"
                echo "Results: $RESULTS"
        fi

        # If there were more than 3 lines returned, something went wrong
        if [ $LINECOUNT -gt 3 ]
        then
                # Return err
                return 2
        fi

        # Check the results to see if any are over 100% usage
        for i in $RESULTS
        do
                if [ $i -gt 100 ]
                then
                        # Return true - it's over!
                        return 0
                fi
        done

        # Return false - it's under
        return 1
}

isSplunkLicenseOver
RETVAL=$?

if $DEBUG
then
        echo "isSplunkLicenseOver returned: $RETVAL"
fi

if [ $RETVAL -eq 0 ]
then
        echo "Splunk license exceeded!"
fi

exit 0