Alerting

How to setup an alert if any index size goes over 90%?

Communicator

Hello,
im trying to create an alert if any of the indexes i have is filled up with more than 90 % of it space? I found something but it gives results of the actual size of the indexes
| eventcount summarize=false reportsize=true index=* | eval sizeMB=size_bytes/(1024*1024)

but nothing regarding on the percentage that is used. maybe there is an app i can install that has this kind of searches ?

Any clue on this ?

1 Solution

SplunkTrust
SplunkTrust

Hi arber,

you can use this REST search:

| rest /services/data/indexes | eval perc=(currentDBSizeMB * 100 / maxTotalDataSizeMB ) | table title currentDBSizeMB maxTotalDataSizeMB perc

and create an alert out of it.

hope this helps ...

cheers, MuS

View solution in original post

SplunkTrust
SplunkTrust

Hi arber,

you can use this REST search:

| rest /services/data/indexes | eval perc=(currentDBSizeMB * 100 / maxTotalDataSizeMB ) | table title currentDBSizeMB maxTotalDataSizeMB perc

and create an alert out of it.

hope this helps ...

cheers, MuS

View solution in original post

Communicator

Never mind i found it 🙂 . Just add the splunkserver
| rest /services/data/indexes | eval perc=(currentDBSizeMB * 100 / maxTotalDataSizeMB ) | table title currentDBSizeMB maxTotalDataSizeMB perc splunk
server

0 Karma

Path Finder

Hi ,

I would like to set up alert for only one specific index..this query shows all the index. Please let me know how can i get it only for that specific index?

Thanks

0 Karma

SplunkTrust
SplunkTrust

un-tested since no Splunk available at this time of the day; but try:

| rest /services/data/indexes | search title=TheIndexYouWant | eval perc=(currentDBSizeMB * 100 / maxTotalDataSizeMB ) | table title currentDBSizeMB maxTotalDataSizeMB perc

Path Finder

hey,

it is working... Thanks!!

0 Karma

SplunkTrust
SplunkTrust

Feel free to up-vote this comment and/or answer 😉

Communicator

Im trying to run this from our main splunk instance. Basically it shows all indexes of all indexers that we have in our infrastructure. But is there a way to tell that this index is from this indexer and so.. Because at the moment with this command you cannot get this info..

0 Karma

SplunkTrust
SplunkTrust
0 Karma

Communicator

thanks a lot

0 Karma

Communicator

Thanks a lot it works

0 Karma