Alerting

Crazy alert

christinmb
Path Finder

Hello, I'm monitoring my PercentFreeSpace in some of my servers so I configurated an alert when the PercentFreeSpace<15 with Time range of 15m and running every minute the search, the problem comes when I want to verify the alert results: I GET 0 EVENTS MATCHING MY SEARCH!

Any idea why this is happening?
Thanks in advanced

0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

That could just mean that you don't have any servers with PercentFreeSpace less than 15%. We would expect no results to show up in that case. Why don't you try it as a search and adjust the number and see if indeed the alert should be bringing back something. If you edit your original question with the search, that would help as well.

View solution in original post

0 Karma

sdaniels
Splunk Employee
Splunk Employee

That could just mean that you don't have any servers with PercentFreeSpace less than 15%. We would expect no results to show up in that case. Why don't you try it as a search and adjust the number and see if indeed the alert should be bringing back something. If you edit your original question with the search, that would help as well.

0 Karma

sdaniels
Splunk Employee
Splunk Employee

I think it might be sending you the results 'always' even though it's not a match, and essentially alerting every time that search runs.

0 Karma

christinmb
Path Finder

Ok, i'll try that, but why do i get an alert if the condition doesnt meets?

0 Karma

sdaniels
Splunk Employee
Splunk Employee

Try changing the alert condition from 'always' to 'if number of events' greater than 0.

0 Karma

christinmb
Path Finder
0 Karma

sdaniels
Splunk Employee
Splunk Employee

You didn't say in your question that you were getting the alerts so didn't realize that. Can you post the search details.

0 Karma

christinmb
Path Finder

But why am I getting tons of alerts if the results doesnt match?

0 Karma

emiller42
Motivator

Can you provide sample events and the actual search you're running?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...