topic Re: Create Splunk Storage (Disk Space) Capacity Alarm (Alert) in Monitoring Splunk

Create Splunk Storage (Disk Space) Capacity Alarm (Alert)

shakeel253 — Wed, 18 Oct 2017 12:52:48 GMT

The OS I am currently using is Redhat, i need help with the query that sends an alert if the DiskSpace goes over 70 percent

host="MONGO" sourcetype=df

kiril123 — Wed, 18 Oct 2017 13:42:09 GMT

Go to Settings -> Monitoring console -> Settings -> Alerts Setup. Then select and configure the following:

DMC Alert - Near Critical Disk Usage

shakeel253 — Wed, 18 Oct 2017 13:47:11 GMT

thank you for the response, but i need a Splunk Query which can be changed to Alert

richgalloway — Wed, 18 Oct 2017 15:42:55 GMT

Try this search. Schedule it to run at some interval (hourly, for example). Set the alert to trigger when the number of results is not zero.

host="MONGO" sourcetype=df | multikv fields Filesystem Type Size Used Avail UsePct MountedOn | convert auto(UsePct) | where UsePct>95