Configuring Disk space alert for Windows server when 85% space alert to send email


 I have installed Splunk forwarder on Windows  server. I would like to configure an alert so everytime the disk is getting full an email would be sent to my email address. The same if the server was turned off or not detected in the network. Could you plase help me?

i check the forum have related info 


sourcetype="WMI:FreeDiskSpace" PercentFreeSpace<10

Metrics index is meaning for? 

and i look for splunk which portal to setup my alert 

Splunk Search Explanation

| mstats avg(LogicalDisk.%_Free_Space) AS "win_storage_free" WHERE index="<name of your metrics index>" host="<names of the hosts you want to check>" instance="<names of drives you want to check)>" instance!="_Total" BY host, instance span=1mSearch metrics index(es) where perfmon disk space data is being collected and filter down to the desired host(s) to check.
| eval storage_used_percent=round(100-win_storage_free,2)Convert percent storage free to percent storage used for readability.
| eval host_dev=printf("%s:%s\\",host,instance)Create a new field that combines the host and disk drive.
| timechart max(storage_used_percent) AS storage_used_percent BY host_devPlot the storage used for each host and disk over time.

Windows disk drive utilization nearing capacity - Splunk Lantern

Monitor data through Windows Management Instrumentation (WMI) - Splunk Documentation 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...