Alerting

Configuring Disk space alert for Windows server when 85% space alert to send email

RSKKEWE
Loves-to-Learn

 I have installed Splunk forwarder on Windows  server. I would like to configure an alert so everytime the disk is getting full an email would be sent to my email address. The same if the server was turned off or not detected in the network. Could you plase help me?

i check the forum have related info 

 

sourcetype="WMI:FreeDiskSpace" PercentFreeSpace<10

Metrics index is meaning for? 

and i look for splunk which portal to setup my alert 

Splunk Search Explanation

| mstats avg(LogicalDisk.%_Free_Space) AS "win_storage_free" WHERE index="<name of your metrics index>" host="<names of the hosts you want to check>" instance="<names of drives you want to check)>" instance!="_Total" BY host, instance span=1mSearch metrics index(es) where perfmon disk space data is being collected and filter down to the desired host(s) to check.
| eval storage_used_percent=round(100-win_storage_free,2)Convert percent storage free to percent storage used for readability.
| eval host_dev=printf("%s:%s\\",host,instance)Create a new field that combines the host and disk drive.
| timechart max(storage_used_percent) AS storage_used_percent BY host_devPlot the storage used for each host and disk over time.

Windows disk drive utilization nearing capacity - Splunk Lantern

Monitor data through Windows Management Instrumentation (WMI) - Splunk Documentation 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...