I have installed Splunk forwarder on Windows server. I would like to configure an alert so everytime the disk is getting full an email would be sent to my email address. The same if the server was turned off or not detected in the network. Could you plase help me?
i check the forum have related info
sourcetype="WMI:FreeDiskSpace" PercentFreeSpace<10
Metrics index is meaning for?
and i look for splunk which portal to setup my alert
Splunk Search Explanation
| | mstats avg(LogicalDisk.%_Free_Space) AS "win_storage_free" WHERE index="<name of your metrics index>" host="<names of the hosts you want to check>" instance="<names of drives you want to check)>" instance!="_Total" BY host, instance span=1m | Search metrics index(es) where perfmon disk space data is being collected and filter down to the desired host(s) to check. |
| | eval storage_used_percent=round(100-win_storage_free,2) | Convert percent storage free to percent storage used for readability. |
| | eval host_dev=printf("%s:%s\\",host,instance) | Create a new field that combines the host and disk drive. |
| | timechart max(storage_used_percent) AS storage_used_percent BY host_dev | Plot the storage used for each host and disk over time. |
Windows disk drive utilization nearing capacity - Splunk Lantern
Monitor data through Windows Management Instrumentation (WMI) - Splunk Documentation
