topic Re: Setting up Alerts for basic things like Disk Space for windows/Unix servers in Monitoring Splunk

Setting up Alerts for basic things like Disk Space for windows/Unix servers

pc591f — Wed, 29 May 2024 12:28:27 GMT

I'm very new to this and found we do not have any alerts setup for basic things like Disk space on drives etc, I've done some basic courses but I don't know what to put after Host= to capture all drives on both windows and Unix

Application Crashes.
System or Service Failures.
Windows Update Errors.
Windows Firewall.
Clearing Event Logs.
Software and Service Installation.
Account Usage Kernel Driver Signing.

Re: Setting up Alerts for basic things like Disk Space for windows/Unix servers

gcusello — Wed, 29 May 2024 13:01:22 GMT

hi @pc591f ,

at first see in documentation how to get data in from forwarders (https://docs.splunk.com/Documentation/Splunk/9.2.1/Data/Usingforwardingagents)

then install on Forwarders one of these apps: Splunk TA for Windows (https://splunkbase.splunk.com/app/742) or Splunk TA for nix (https://splunkbase.splunk.com/app/833), remembering to enable inputs that by default are disabled.

Having those logs, youcan create your own searches.

The most difficoult is to know what to search, but this isn't a Splunk knowledge.

To understand how to create the search, you can follow the Splunk Search Tutorial (https://docs.splunk.com/Documentation/SplunkCloud/8.1.0/SearchTutorial/WelcometotheSearchTutorial).

Ciao.

Giuseppe

Re: Setting up Alerts for basic things like Disk Space for windows/Unix servers

pc591f — Wed, 29 May 2024 13:14:00 GMT

Hi Gcusello

Thanks for the information, Forwarders are installed on all servers currently, its just setting up the searches are my colleague is away for the week and i just trying to set up some basic alerts, thanks for your advice

Re: Setting up Alerts for basic things like Disk Space for windows/Unix servers

gcusello — Wed, 29 May 2024 13:15:58 GMT

Hi @pc591f,

check if the add-ons I mentioned are installed and if the inputs that takes the information you need are enabled.

If yes, you have only to create your searches.

if not, you haven't the information for your Use Cases.

Ciao.

Giuseppe