<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Additional alerts for Oracle for file system Approching Maximum Capacity? in Alerting</title>
    <link>https://community.splunk.com/t5/Alerting/Additional-alerts-for-Oracle-for-file-system-Approching-Maximum/m-p/617053#M14399</link>
    <description>&lt;P&gt;Hi Everyone,&lt;/P&gt;
&lt;P&gt;I run into an issue today in SIT where TIV0 was inaccessible because a similar directory was full.&lt;/P&gt;
&lt;P&gt;I'm trying to set one alert for DEV and one for SIT and the folder path for each environment is :&lt;/P&gt;
&lt;P&gt;DEV:/mms/ora1200/u00/oracle.&lt;/P&gt;
&lt;P&gt;SIT:/mms/ora1201/u00/oracle.&lt;/P&gt;
&lt;P&gt;this is what i have so far :&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;index=A   "/mms/ora1200/u00/oracle"  source= B

| stats latest(storage_used*) as storage_used*  latest(storage_free*) as storage_free* by host mount

| where storage_used_percent&amp;gt;90

| eval storage_used=if(storage_used&amp;gt;1000,(storage_used/1000). " GB" ,storage_used+"  MB"),  storage_free=if(storage_free&amp;gt;1000, (storage_free/1000, (storage_free/1000).  " GB", storage_free+" MB")&lt;/LI-CODE&gt;
&lt;P&gt;Any feedback will be appreciated.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Fri, 14 Oct 2022 00:01:29 GMT</pubDate>
    <dc:creator>majilan1</dc:creator>
    <dc:date>2022-10-14T00:01:29Z</dc:date>
    <item>
      <title>Additional alerts for Oracle for file system Approching Maximum Capacity?</title>
      <link>https://community.splunk.com/t5/Alerting/Additional-alerts-for-Oracle-for-file-system-Approching-Maximum/m-p/617053#M14399</link>
      <description>&lt;P&gt;Hi Everyone,&lt;/P&gt;
&lt;P&gt;I run into an issue today in SIT where TIV0 was inaccessible because a similar directory was full.&lt;/P&gt;
&lt;P&gt;I'm trying to set one alert for DEV and one for SIT and the folder path for each environment is :&lt;/P&gt;
&lt;P&gt;DEV:/mms/ora1200/u00/oracle.&lt;/P&gt;
&lt;P&gt;SIT:/mms/ora1201/u00/oracle.&lt;/P&gt;
&lt;P&gt;this is what i have so far :&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;index=A   "/mms/ora1200/u00/oracle"  source= B

| stats latest(storage_used*) as storage_used*  latest(storage_free*) as storage_free* by host mount

| where storage_used_percent&amp;gt;90

| eval storage_used=if(storage_used&amp;gt;1000,(storage_used/1000). " GB" ,storage_used+"  MB"),  storage_free=if(storage_free&amp;gt;1000, (storage_free/1000, (storage_free/1000).  " GB", storage_free+" MB")&lt;/LI-CODE&gt;
&lt;P&gt;Any feedback will be appreciated.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 14 Oct 2022 00:01:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Additional-alerts-for-Oracle-for-file-system-Approching-Maximum/m-p/617053#M14399</guid>
      <dc:creator>majilan1</dc:creator>
      <dc:date>2022-10-14T00:01:29Z</dc:date>
    </item>
    <item>
      <title>Re: Additional alerts for Oracle for file system Approching Maximum Capacity?</title>
      <link>https://community.splunk.com/t5/Alerting/Additional-alerts-for-Oracle-for-file-system-Approching-Maximum/m-p/617095#M14404</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/246610"&gt;@majilan1&lt;/a&gt;,&lt;/P&gt;&lt;P&gt;what is the result of your search?&lt;/P&gt;&lt;P&gt;does it run or not?&lt;/P&gt;&lt;P&gt;if not, what's the output?&lt;/P&gt;&lt;P&gt;Anyway I see thet you used a field "storage_used_percent" in the where command that isn't present in the stats command: after a stats command you have only the fields present in the command itself, in other words you don't have the field&amp;nbsp;"storage_used_percent".&lt;/P&gt;&lt;P&gt;you have to calculate it from the fields you have using eval or, if present, to add it to the stats command.&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;index=A   "/mms/ora1200/u00/oracle"  source= B
| stats 
   latest(storage_used*) as storage_used*
   latest(storage_free*) as storage_free*
   latest(storage_used_percent) AS storage_used_percent
   BY host mount
| where storage_used_percent&amp;gt;90
| eval 
   storage_used=if(storage_used&amp;gt;1000,(storage_used/1000)." GB",storage_used+"  MB"),
   storage_free=if(storage_free&amp;gt;1000,(storage_free/1000,(storage_free/1000).  " GB", storage_free+" MB")&lt;/LI-CODE&gt;&lt;P&gt;Ciao.&lt;/P&gt;&lt;P&gt;Giuseppe&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 14 Oct 2022 06:39:10 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Additional-alerts-for-Oracle-for-file-system-Approching-Maximum/m-p/617095#M14404</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2022-10-14T06:39:10Z</dc:date>
    </item>
    <item>
      <title>Re: Additional alerts for Oracle for file system Approching Maximum Capacity?</title>
      <link>https://community.splunk.com/t5/Alerting/Additional-alerts-for-Oracle-for-file-system-Approching-Maximum/m-p/617124#M14407</link>
      <description>&lt;P&gt;My query does run, but it generates 0 events, I tried yours and is the samething.&lt;/P&gt;</description>
      <pubDate>Fri, 14 Oct 2022 12:45:19 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Additional-alerts-for-Oracle-for-file-system-Approching-Maximum/m-p/617124#M14407</guid>
      <dc:creator>majilan1</dc:creator>
      <dc:date>2022-10-14T12:45:19Z</dc:date>
    </item>
  </channel>
</rss>

