Splunk Hogs is a quick Perl script that was written to find what systems are sending too many events to Splunk and using up all the licenses. This is good for several reasons: developers will turn debugging on and use up all the licenses, which will help catch it early; INFO messages get turned on and useless events will be sent, filling up the licenses; issues will be detected that were being ignored by others. The advantage over Splunk's SaveSearch is that it outputs the raw data, so you can import it into Nagios or other tools. It collects raw data from Splunk that consists of the host, Splunk server, and the count of events that took place.
|Tags||splunk license hogs spam perl|
|Operating Systems||Unix Linux|