https://community.splunk.com/t5/Splunk-ITSI/Monitoring-Disk-Space-in-ITSI-and-having-issue-with-Maintenance/m-p/550458#M2318 <P>Hi</P><P>I have a inherited a KPI that monitors disk space in ITSI, the search works fine and returns a results when the thresholds are breached however the episodes continue even when the server is in maintenance mode.</P><P>I think I know why but don't yet know how to work around it.</P><P>This is the KPI search:</P><LI-CODE lang="markup">| mstats avg(LogicalDisk.%_Free_Space) as "logicaldisk_free_space" avg(PhysicalDisk.%_Disk_Read_Time) as "physicaldisk_read_time" avg(PhysicalDisk.%_Disk_Write_Time) as "physicaldisk_write_time" avg(Network_Interface.Packets_Received/sec) as "network_packets_received_per_second" avg(Network_Interface.Packets_Sent/sec) as "network_packets_sent_per_second" avg(Network_Interface.Bytes_Received/sec) as "network_bytes_received_per_second" avg(Network_Interface.Bytes_Sent/sec) as "network_bytes_sent_per_second" avg(Network_Interface.Packets_Outbound_Errors) as "network_packets_outbound_errors" WHERE `sai_metrics_indexes` AND instance!=_Total instance!=P: by host,instance span=30s | eval host_dev=host . ":" . instance | eval "physicaldisk_total_time" = physicaldisk_read_time + physicaldisk_write_time | eval "network_packets_total_per_second" = network_packets_received_per_second + network_packets_sent_per_second | eval "network_mbs_total_per_second" = (network_bytes_received_per_second + network_bytes_sent_per_second)/1000000</LI-CODE><P>&nbsp;</P><P>The Threshold field is <STRONG>logical_free_space</STRONG></P><P>The Split by field is <STRONG>host_dev</STRONG> which as you can see combines the host name with the disk device like this<BR />HOST1234:C:</P><P>The data is filtered by service with the <STRONG>host</STRONG> field</P><P>The result in the service analyser looks good<BR /><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image (1).png" style="width: 994px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14049i51C405BAB7ADB403/image-size/large?v=v2&amp;px=999" role="button" title="image (1).png" alt="image (1).png" /></span></P><P>Problem is with the Entity Name now being HOSTNAME:C: when the HOST is put into maintenance this KPI keeps creating episodes.</P><P>Can someone help me with a practical way to do this and still use maintenance mode successfully?</P><P>Cheers</P> Tue, 04 May 2021 22:33:37 GMT proyleJDS 2021-05-04T22:33:37Z https://community.splunk.com/t5/Splunk-ITSI/Monitoring-Disk-Space-in-ITSI-and-having-issue-with-Maintenance/m-p/550458#M2318 <P>Hi</P><P>I have a inherited a KPI that monitors disk space in ITSI, the search works fine and returns a results when the thresholds are breached however the episodes continue even when the server is in maintenance mode.</P><P>I think I know why but don't yet know how to work around it.</P><P>This is the KPI search:</P><LI-CODE lang="markup">| mstats avg(LogicalDisk.%_Free_Space) as "logicaldisk_free_space" avg(PhysicalDisk.%_Disk_Read_Time) as "physicaldisk_read_time" avg(PhysicalDisk.%_Disk_Write_Time) as "physicaldisk_write_time" avg(Network_Interface.Packets_Received/sec) as "network_packets_received_per_second" avg(Network_Interface.Packets_Sent/sec) as "network_packets_sent_per_second" avg(Network_Interface.Bytes_Received/sec) as "network_bytes_received_per_second" avg(Network_Interface.Bytes_Sent/sec) as "network_bytes_sent_per_second" avg(Network_Interface.Packets_Outbound_Errors) as "network_packets_outbound_errors" WHERE `sai_metrics_indexes` AND instance!=_Total instance!=P: by host,instance span=30s | eval host_dev=host . ":" . instance | eval "physicaldisk_total_time" = physicaldisk_read_time + physicaldisk_write_time | eval "network_packets_total_per_second" = network_packets_received_per_second + network_packets_sent_per_second | eval "network_mbs_total_per_second" = (network_bytes_received_per_second + network_bytes_sent_per_second)/1000000</LI-CODE><P>&nbsp;</P><P>The Threshold field is <STRONG>logical_free_space</STRONG></P><P>The Split by field is <STRONG>host_dev</STRONG> which as you can see combines the host name with the disk device like this<BR />HOST1234:C:</P><P>The data is filtered by service with the <STRONG>host</STRONG> field</P><P>The result in the service analyser looks good<BR /><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image (1).png" style="width: 994px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14049i51C405BAB7ADB403/image-size/large?v=v2&amp;px=999" role="button" title="image (1).png" alt="image (1).png" /></span></P><P>Problem is with the Entity Name now being HOSTNAME:C: when the HOST is put into maintenance this KPI keeps creating episodes.</P><P>Can someone help me with a practical way to do this and still use maintenance mode successfully?</P><P>Cheers</P> Tue, 04 May 2021 22:33:37 GMT https://community.splunk.com/t5/Splunk-ITSI/Monitoring-Disk-Space-in-ITSI-and-having-issue-with-Maintenance/m-p/550458#M2318 proyleJDS 2021-05-04T22:33:37Z