https://community.splunk.com/t5/Monitoring-Splunk/Issue-with-alert-running-from-DMC-for-memory-overrun/m-p/520160#M4458 <P>Hello,</P> <P>We have an alert in place that uses the REST API to determine when a server is using to much memory and then the server is restarted.&nbsp; It had been working great, however last week we had an alert come through that listed every box connected to the DMC.&nbsp; This caused some restarts that created an issue.&nbsp; When trying to look at the stats for the machines at the time of the alert, none of the servers show meeting that condition.&nbsp; Am I doing something wrong here?</P> <P>We are using the below search:</P> <LI-CODE lang="markup">| rest splunk_server_group=dmc_group_* /services/server/status/resource-usage/hostwide | eval percentage=round(mem_used/mem,3)*100 | where percentage &gt; 90 | fields splunk_server, percentage, mem_used, mem | rename splunk_server AS ServerName, mem AS "Physical memory installed (MB)", percentage AS "Memory used (%)", mem_used AS "Memory used (MB)" | rex field=ServerName "\s*(?&lt;ServerName&gt;\w+[\d+]).*" | table ServerName | sort - ServerName | stats list(ServerName) as ServerName delim="," | nomv ServerName</LI-CODE> Fri, 25 Sep 2020 20:46:40 GMT mookiie2005 2020-09-25T20:46:40Z https://community.splunk.com/t5/Monitoring-Splunk/Issue-with-alert-running-from-DMC-for-memory-overrun/m-p/520160#M4458 <P>Hello,</P> <P>We have an alert in place that uses the REST API to determine when a server is using to much memory and then the server is restarted.&nbsp; It had been working great, however last week we had an alert come through that listed every box connected to the DMC.&nbsp; This caused some restarts that created an issue.&nbsp; When trying to look at the stats for the machines at the time of the alert, none of the servers show meeting that condition.&nbsp; Am I doing something wrong here?</P> <P>We are using the below search:</P> <LI-CODE lang="markup">| rest splunk_server_group=dmc_group_* /services/server/status/resource-usage/hostwide | eval percentage=round(mem_used/mem,3)*100 | where percentage &gt; 90 | fields splunk_server, percentage, mem_used, mem | rename splunk_server AS ServerName, mem AS "Physical memory installed (MB)", percentage AS "Memory used (%)", mem_used AS "Memory used (MB)" | rex field=ServerName "\s*(?&lt;ServerName&gt;\w+[\d+]).*" | table ServerName | sort - ServerName | stats list(ServerName) as ServerName delim="," | nomv ServerName</LI-CODE> Fri, 25 Sep 2020 20:46:40 GMT https://community.splunk.com/t5/Monitoring-Splunk/Issue-with-alert-running-from-DMC-for-memory-overrun/m-p/520160#M4458 mookiie2005 2020-09-25T20:46:40Z