topic Splunk Alert for disk space usage in Monitoring Splunk

Splunk Alert for disk space usage

shakeel253 — Mon, 11 Dec 2017 17:07:23 GMT

I have a query that monitors DiskSpace usage and sends out alert if the diskspace goes up more then 80 percent. My Splunk account has a limit on realtime alert and i have more then 1 mongo servers so I tried using host "mongo*" since they are Mongo1, mongo2 ..
so this way I have just 1 alert for all the mongo server.

The alert works corrects but I get lot of emails about different servers.; I need a configuration or a query where I get just 1 alert which shows all the mongo servers that surpass 80 percent threshold instead of 10 different email.

Can someone help???

below is the query that I am using

host="MONGO*" sourcetype=df | multikv fields Filesystem Type Size Used Avail UsePct MountedOn | convert auto(UsePct) | where UsePct>80

Re: Splunk Alert for disk space usage

rphillips_splk — Mon, 11 Dec 2017 17:53:43 GMT

You can run a search and output it to a table with whatever fields you want to display and alert on

host="MONGO*" sourcetype=df | multikv fields Filesystem Type Size Used Avail UsePct MountedOn | convert auto(UsePct) | where UsePct>80 | table host Filesystem Type Size Used Avail UsePct MountedOn

When you save this search as an alert set your trigger conditions to:
- Number of Results is greater than 0
- Trigger Once

Re: Splunk Alert for disk space usage

shakeel253 — Tue, 12 Dec 2017 19:32:30 GMT

thank you the query worked