topic Re: Alerting on free space AND % free space - Windows-based systems in Splunk Search

Alerting on free space AND % free space - Windows-based systems

jmo1 — Wed, 04 Nov 2020 17:13:37 GMT

We are collecting perfmon information - "Free Megabytes" and "% Free Space". All is well in the collection on these items. We have an alerts that alerts us when free space is less than 10 "Free Megabytes". Again, all is well.

I now need to modify the alert to report any hosts where "Free Megabytes" is less than 10 AND "% Free Space" is than 20. (Numbers are just an example). I trying but haven't gotten it to work. Here is what I have in my testing...

sourcetype="Perfmon:Free Disk Space" instance!=_Total counter="% Free Space" Value<20 [ search host=* sourcetype="Perfmon:Free Disk Space" instance!=_Total counter="Free Megabytes" Value<10000 | return host ] | table host, instance, Value

Two concerns..

1. I need to look at all hosts all drives but not _Total (which combines)

2. I need to alert only if "Free Megabytes" < 10 and "% Free Space" <20

Any help would be appreciated.

Re: Alerting on free space AND % free space - Windows-based systems

richgalloway — Wed, 04 Nov 2020 18:17:33 GMT

What does "haven't gotten it to work" mean? Do you get errors? If you get no results, have you confirmed there should be results?

At first glance, the query looks like it should work so you should verify you have data that meet the search criteria.

BTW, including an index name in the query will help improve performance.

Re: Alerting on free space AND % free space - Windows-based systems

jmo1 — Wed, 04 Nov 2020 18:24:54 GMT

Thanks for the response. I think part of my logic is sound, but if I run the following...

sourcetype="Perfmon:Free Disk Space" instance!=_Total counter="% Free Space" Value>0 [ search host=* sourcetype="Perfmon:Free Disk Space" instance!=_Total counter="Free Megabytes" Value>0 | return host ] | table host, instance, Value

Which says basically, return all hosts/drives where Free Megabytes > 0 and % Free Space >0, which should return everything. I get the return from a single host.

How do I get it to iterate through all of the hosts?

And thanks for the index suggestion.

Re: Alerting on free space AND % free space - Windows-based systems

jmo1 — Thu, 05 Nov 2020 15:04:23 GMT

Answering my own question..

In order to get it to return all hits, you need to supply a count. So rather than

return host

I need to add a 'count'. I used 1000 as a safe number, it doesn't appear to matter if you don't have 1000 items, so guess big.

return 1000 host