How to create a Splunk alert for when storage on host reaches 75%?

Path Finder

I need to create a Splunk alert that will trigger when storage on /vi/vip_pdh/00d for a host reaches at least 90% capacity.

index=A sourcetype=B   /vi/vip_pdh OR /var/log  earliest=-2h

| eval UsePct=rtrim(UsePct,"%")

| stats latest(UsePct) as UsePct by MountedOn host.

Just a Slight correction, I want to monitor both /vi/vip_pdh and /var/log.


Labels (1)
0 Karma

Revered Legend

Add following to end of your search

| where tonumber(UsePct)>=90
0 Karma
Get Updates on the Splunk Community!

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...

Observability Cloud | AWS PrivateLink Enabled for Splunk Observability Cloud

We’ve enabled AWS PrivateLink for Observability Cloud, giving you an additional inbound connection to send ...

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...