How to setup splunk disk space alert(s) for multiple conditions in a single query ?

rithwik572 — Mon, 29 Oct 2018 19:01:07 GMT

Hi,

Is it possible to setup alert for filesystem diskspace reaching threshold for 80%(alert should be triggered every 6 hrs), 85% ( alert should be triggered every 1 hr) and 90% alert should be triggered ( every 30 min)? I want 80% alert to be stopped when filesystem diskspace reaches 85% and similarly for 90% . I am not sure how to achieve this in splunk. Any suggestions ?

I can setup 3 individual alerts for 3 different thresholds but I am not sure how to achieve this in 1 alert query?

Thanks.

Thanks

Re: How to setup splunk disk space alert(s) for multiple conditions in a single query ?

iamarkaprabha — Tue, 30 Oct 2018 05:14:59 GMT

Hi ,

Why don't you try case statements for this one. If the cpu went up to 85% and more then it will store the data in one field and vice versa

using eval - eval description=case(status == 200, "OK", status ==404, "Not found", status == 500, "Internal Server Error")

http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/ConditionalFunctions#case.28X.2C.22Y.22.2C....29

topic How to setup splunk disk space alert(s) for multiple conditions in a single query ? in Alerting

How to setup splunk disk space alert(s) for multiple conditions in a single query ?

Re: How to setup splunk disk space alert(s) for multiple conditions in a single query ?