步骤:
安装目录为/opt/
- 停止Splunk:/opt/splunk/bin/splunk stop
- 删除splunk/var/lib/splunk/fishbucket/目录下40开头的一个纯数字文件
- 删除splunk/var/lib/splunk/fishbucket/rawdata/目录里所有文件
- 删除splunk/var/log/splunk/文件夹中license开头的所有文件
- 启动splunk
/opt/splunk/bin/splunk stop
rm -rf /opt/splunk/var/lib/splunk/fishbucket/40*
rm -rf /opt/splunk/var/lib/splunk/fishbucket/rawdata/*
rm -rf /opt/splunk/var/log/splunk/license*
/opt/splunk/bin/splunk start
script:
#!/bin/bash
# Author: tacoff
# Comment: clean license limit
SPLUNK_HOME="/opt/splunk"
SPLUNK_BIN="$SPLUNK_HOME/bin/splunk"
SPLUNK_LOGDIR="$SPLUNK_HOME/var/log/splunk"
USER="admin"
PASSWORD="password"
FLAG_CLEAN=""
function log_msg() {
current_time=$(date +"%F %T")
MSG="$current_time $1"
echo $MSG
}
function exec_reset() {
log_msg "execute the license clean"
SPLUNK_DATADIR=$($SPLUNK_BIN show datastore-dir | grep -Eo "/\w+.*")
log_msg "SPLUNK_DATADIR: $SPLUNK_DATADIR"
$SPLUNK_BIN stop
rm -rf $SPLUNK_DATADIR/fishbucket/40*
# ls -l $SPLUNK_DATADIR/fishbucket/40*
rm -rf $SPLUNK_DATADIR/fishbucket/rawdata/*
# ls -ld $SPLUNK_DATADIR/fishbucket/rawdata/
rm -rf $SPLUNK_LOGDIR/license*
# ls -l $SPLUNK_LOGDIR/license*
$SPLUNK_BIN start
}
function check_health() {
FLAG_CLEAN=$($SPLUNK_BIN search "index=main earliest=-3m | stats count" -auth $USER:$PASSWORD 2>&1 | grep -o "license limit too many times")
}
function main() {
log_msg "ready to check the license"
check_health
license_status=$FLAG_CLEAN
log_msg "license status: $license_status"
if [[ $license_status != "" ]]
then
exec_reset
fi
}
main
评论区