How to setup an alert if any index size goes over 90%?

[arber]

Hello,
im trying to create an alert if any of the indexes i have is filled up with more than 90 % of it space? I found something but it gives results of the actual size of the indexes
| eventcount summarize=false report_size=true index=* | eval size_MB=size_bytes/(1024*1024)

but nothing regarding on the percentage that is used. maybe there is an app i can install that has this kind of searches ?

Any clue on this ?

[MuS · Accepted solution]

Hi arber,

you can use this REST search:

| rest /services/data/indexes | eval perc=(currentDBSizeMB * 100 / maxTotalDataSizeMB ) | table title currentDBSizeMB maxTotalDataSizeMB perc

and create an alert out of it.

hope this helps ...

cheers, MuS

[arber]

Never mind i found it 🙂 . Just add the splunk_server
| rest /services/data/indexes | eval perc=(currentDBSizeMB * 100 / maxTotalDataSizeMB ) | table title currentDBSizeMB maxTotalDataSizeMB perc splunk_server

[Abilan1]

Hi ,

I would like to set up alert for only one specific index..this query shows all the index. Please let me know how can i get it only for that specific index?

Thanks

[MuS]

un-tested since no Splunk available at this time of the day; but try:

| rest /services/data/indexes | search title=TheIndexYouWant | eval perc=(currentDBSizeMB * 100 / maxTotalDataSizeMB ) | table title currentDBSizeMB maxTotalDataSizeMB perc

[Abilan1]

hey,

it is working... Thanks!!

[MuS]

Feel free to up-vote this comment and/or answer 😉

[arber]

Im trying to run this from our main splunk instance. Basically it shows all indexes of all indexers that we have in our infrastructure. But is there a way to tell that this index is from this indexer and so.. Because at the moment with this command you cannot get this info..

[MuS]

use splunk_serverfor the REST command http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Rest

[arber]

thanks a lot

[arber]

Thanks a lot it works