topic How to setup email alert for low disk space on partition? in Alerting

How to setup email alert for low disk space on partition?

kavraja — Tue, 16 Sep 2014 06:44:28 GMT

I got a message today saying

"You are low in disk space on partition "D:\splunk\sep\db". Indexing has been paused. Will resume when free disk space rises above 1000MB."

I was hoping if there is a way of creating an email alert for this to make such incidents easier to track so I can get notified if this happens while I'm not logged onto splunk at the time.

Thanks

Re: How to setup email alert for low disk space on partition?

linu1988 — Tue, 16 Sep 2014 06:58:40 GMT

Hello Kavraja,
This is kind of easy. Monitor your local server with Splunk and see when it closes to the limit. Run a alert in the same.

Thanks,
L

Re: How to setup email alert for low disk space on partition?

MuS — Tue, 16 Sep 2014 07:00:32 GMT

Hi kavraja,

If you're collecting WMI data you can build a search like this:

 sourcetype="WMI:FreeDiskSpace"  PercentFreeSpace<10

Otherwise you will need to enable some WMI inputs and read this: Monitor WMI-based data
Once you got this search working, you can easily define an alert out of it.

hope this helps ...

cheers, MuS

Re: How to setup email alert for low disk space on partition?

kavraja — Tue, 16 Sep 2014 07:23:22 GMT

Thanks for the help linu1988

Re: How to setup email alert for low disk space on partition?

kavraja — Tue, 16 Sep 2014 07:24:06 GMT

Thanks for the help MuS. Works fine now

Re: How to setup email alert for low disk space on partition?

martin_mueller — Tue, 16 Sep 2014 07:47:37 GMT

If you're on a fairly recent version of Splunk you don't need to collect the data yourself, it's already there in the _introspection index:

index=_introspection component=Partitions | timechart min(data.free) by data.mount_point

Re: How to setup email alert for low disk space on partition?

kavraja — Tue, 16 Sep 2014 07:58:43 GMT

I'm on 6.0 but this index didn't seem to work. Thanks for the help though.

Re: How to setup email alert for low disk space on partition?

martin_mueller — Tue, 16 Sep 2014 08:02:38 GMT

It's been introduced in 6.1.0 😞

Re: How to setup email alert for low disk space on partition?

kavraja — Wed, 17 Sep 2014 00:31:18 GMT

Just my luck