I need to create a Splunk alert that will trigger when storage on /vi/vip_pdh/00d for a host reaches at least 90% capacity.
index=A sourcetype=B /vi/vip_pdh OR /var/log earliest=-2h
| eval UsePct=rtrim(UsePct,"%")
| stats latest(UsePct) as UsePct by MountedOn host.
Just a Slight correction, I want to monitor both /vi/vip_pdh and /var/log.
Thanks!
Add following to end of your search
| where tonumber(UsePct)>=90