Alerting

Crazy alert

Path Finder

Hello, I'm monitoring my PercentFreeSpace in some of my servers so I configurated an alert when the PercentFreeSpace<15 with Time range of 15m and running every minute the search, the problem comes when I want to verify the alert results: I GET 0 EVENTS MATCHING MY SEARCH!

Any idea why this is happening?
Thanks in advanced

0 Karma
1 Solution

Splunk Employee
Splunk Employee

That could just mean that you don't have any servers with PercentFreeSpace less than 15%. We would expect no results to show up in that case. Why don't you try it as a search and adjust the number and see if indeed the alert should be bringing back something. If you edit your original question with the search, that would help as well.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

That could just mean that you don't have any servers with PercentFreeSpace less than 15%. We would expect no results to show up in that case. Why don't you try it as a search and adjust the number and see if indeed the alert should be bringing back something. If you edit your original question with the search, that would help as well.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

I think it might be sending you the results 'always' even though it's not a match, and essentially alerting every time that search runs.

0 Karma

Path Finder

Ok, i'll try that, but why do i get an alert if the condition doesnt meets?

0 Karma

Splunk Employee
Splunk Employee

Try changing the alert condition from 'always' to 'if number of events' greater than 0.

0 Karma

Path Finder
0 Karma

Splunk Employee
Splunk Employee

You didn't say in your question that you were getting the alerts so didn't realize that. Can you post the search details.

0 Karma

Path Finder

But why am I getting tons of alerts if the results doesnt match?

0 Karma

Motivator

Can you provide sample events and the actual search you're running?

0 Karma