Why was the false alert triggered?

majilan1 — Wed, 09 Nov 2022 17:00:53 GMT

Hi Folks,

I can't see what would have caused the false alert to triggered: when I checked this directory I can see plenty of space :

Size: 500g Used: 9.6g Avail: 491g use%: 2%

the query looks like this:

index=a sourcetype=b MountedON="d" PercentUsedSpace > 90

| stats latest(PercentUsedSpace) as PercentUsedSpace latest(Avail) as Avail latest(Used) as Used latest(UsePct) as UsePct by MountedON

| fields MountedON UsePct Used Avail

| rename MountedON as "Mount" UsePct as "Percent Used" Used as "Used Space" Avail as "Available Space"

Re: Why was the false alert triggered?

vishalduttauk — Mon, 14 Nov 2022 08:44:27 GMT

Hi @majilan1,

I have a number of alerts based on something similar and this is the search I use. The search doesn't look at the D drive but you can always add in mount="D:".

source="PerfmonMK:LogicalDisk" instance!= C: instance!=_Total %_Free_Space<10

topic Why was the false alert triggered? in Alerting

Why was the false alert triggered?

Re: Why was the false alert triggered?