topic Re: Sending an alert - setting a threshold in Alerting

Sending an alert - setting a threshold

twieczorkowski — Wed, 30 May 2012 17:13:45 GMT

Hi,

I want to set an alert about low disk space.

But when I want to create an alert there is no option for such threshold like MB of free disk space to set???

Mail is sending every time the disk space is checked???

Please help.

BR,
Tom

Re: Sending an alert - setting a threshold

Ayn — Wed, 30 May 2012 18:19:17 GMT

What do the events that you're triggering on look like? Splunk doesn't have specific values for disk space etc because it is agnostic about such things - it just "sees" values, it's up to you to provide the intelligence for the alert thresholds.

Re: Sending an alert - setting a threshold

sdaniels — Wed, 30 May 2012 19:12:14 GMT

Get the Splunk for Microsoft Windows app and that will get you all the field extractions and dashboard views. Then you'll be able to run a search like this for your alert. Or you'll also find examples based on percentages i'm sure as well.

sourcetype="WMI:FreeDiskSpace" host=some_server Name="C:" FreeMegabytes < 2048