topic Re: Cannot receive e-mail notification in Alerting

Why am I not receiving e-mail notification?

ravir_jbp — Tue, 22 Mar 2022 11:52:54 GMT

I am able to perfom search for disk space and can see the reuslts. However, I am not getting alert when I setup it in alert option. Below are the settings I have used: Search script: =============== index=perfmon host=XXXXXX OR host=YYYYYYYsourcetype="Perfmon:LogicalDisk" counter="% Free Space" instance="C:" OR instance="D:" OR instance="E:" Value earliest=-1m latest=now |dedup instance host| sort host| eval Value=round(Value,0)| where Value<50| stats list(host),list(instance),list(Value)| rename list(host) as Servers, list(instance) as Drives, list(Value) as FreeSpaceLeft% Cron expression : ===================== */5 * * * * Trigger alert condition: ========================= search Value <= 50 CAn you please help me on where it went wrong. I am not getting alert for this condition.

Re: Cannot receive e-mail notification

gcusello — Tue, 22 Mar 2022 11:24:18 GMT

Hi @ravir_jbp,

let me understand: you inserted the condition

| where Value<50

inside the search, so if you have results the alert must trigger, is it correct?

in this case the condition to set for the alert activation isn't "value<=0" but "results>0".

Ciao.

Giuseppe

Re: Cannot receive e-mail notification

ravir_jbp — Tue, 22 Mar 2022 11:32:57 GMT

Hi @gcusello ,

Yes firstly I am trying to filter which drive has space left below 50 % and if condition is met then I need to send e-mail alert. That is why I used Value <50.

Shall I use results>0 in the trigger condition? I am confused here.

Re: Cannot receive e-mail notification

gcusello — Tue, 22 Mar 2022 11:39:10 GMT

HI @ravir_jbp,

Yes, you have to put the condition only in one point: in the search or in the triggering conditions.

my hint is to put all the conditions in the search and trigger the alert when you have results (results>0), without putting the condition in the triggering conditions.

Ciao.

Giuseppe

Re: Cannot receive e-mail notification

ravir_jbp — Tue, 22 Mar 2022 12:07:23 GMT

Hi @gcusello ,

Thank you very much. This worked for me!!! Thank you again.

Re: Cannot receive e-mail notification

gcusello — Tue, 22 Mar 2022 12:11:43 GMT

Hi @ravir_jbp,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉