i am sending from a host to splunk cloud logs from the disk usage. Here is an example how the events are:
/dev/nvme4n1p1 xfs 50G 555M 50G 2% 25M 33K 25M 1% /var/www
where "2%" field is called as "Use_". How can i create an alert/search when this number (without the percentage symbol) is higher than 80 ?
@gcusello i have an issue here with this regex... it is not filtering this type of event:
/dev/mapper/group1-mountpoint_www xfs 9.0G 674M 8.4G 8% 4.5M 33K 4.5M 1% /var/www
basically what changes is the filesystem name (uses "-" and "_") and the size of the numbers and the sizy (M, G, K).
PS: I know that in your example the disk needs to be higher than 80, but i changed the value to 2.