How to create alerts for disk space for each drive, when the space is less than 1GB?

Contributor

Hi,

The answer to this is probably so easy that I can't see it, but I am collecting disk info from my servers and creating alert when space is less than 1gb. The problem is that I have multiple drives in servers and each has different size, here is my query: basically if the size is less than 1 GB in either c or d drive send me an alert.

``````index="pa"  host="NOC"  Name="C:" OR Name="D:" FreeSpace | eval FreeSpace_in_GB = round((FreeSpace/1024/1024/1024), 2)|eval Size_in_GB = round((Size/1024/1024/1024),2)|table host,Name,Size_in_GB,FreeSpace_in_GB| dedup Name|search FreeSpace_in_GB < 1
``````

Now I need to set this to less than %20 for each disk so it is going to be less than 14 for D drive and less than 20 for D drive.
When I add this to my search I am only getting c drive. What am I missing here?

``````index="pa"  host="NOC"  Name="C:" OR Name="D:" FreeSpace | eval FreeSpace_in_GB = round((FreeSpace/1024/1024/1024), 2)|eval Size_in_GB = round((Size/1024/1024/1024),2)|table host,Name,Size_in_GB,FreeSpace_in_GB| dedup Name|search Name="C:" FreeSpace_in_GB < 56 OR Name="D:" FreeSpace_in_GB <70
``````

I mean I can create 2 different alerts, one for c and one for d but I am sure I should be able to accomplish this with one query,right?

Thanks

Tags (3)
1 Solution
Revered Legend

You've your total size and FreeSpace available, so you can just compare the %difference in your where clause. This way you don't have to hard code any size thresholds.

``````index="pa"  host="NOC"  Name="C:" OR Name="D:" FreeSpace | eval FreeSpace_in_GB = round((FreeSpace/1024/1024/1024), 2)|eval Size_in_GB = round((Size/1024/1024/1024),2)|table host,Name,Size_in_GB,FreeSpace_in_GB | eval FreeSpacePercent=(FreeSpace_in_GB*100/Size_in_GB) | where FreeSpacePercent<20
``````
Revered Legend

You've your total size and FreeSpace available, so you can just compare the %difference in your where clause. This way you don't have to hard code any size thresholds.

``````index="pa"  host="NOC"  Name="C:" OR Name="D:" FreeSpace | eval FreeSpace_in_GB = round((FreeSpace/1024/1024/1024), 2)|eval Size_in_GB = round((Size/1024/1024/1024),2)|table host,Name,Size_in_GB,FreeSpace_in_GB | eval FreeSpacePercent=(FreeSpace_in_GB*100/Size_in_GB) | where FreeSpacePercent<20
``````
Contributor

Contributor

just to make sure i changed it to <90 so i could get results

Revered Legend

Can you run it without where clause and see of all fields have values? May be post the output here.

Contributor

i've changed the order in the query and now it seems to be working.i will test it thanks

FreeSpace | eval FreeSpace_in_GB = round((FreeSpace/1024/1024/1024), 2)|eval Size_in_GB = round((Size/1024/1024/1024),2)|eval freepercent = (FreeSpace_in_GB*100/Size_in_GB)|dedup Name|search freepercent < 94|table host,Name,Size_in_GB,FreeSpace_in_GB

i can also get results using where instead of search

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...