Alerting

How to setup email alert for low disk space on partition?

kavraja
Path Finder

I got a message today saying

"You are low in disk space on partition "D:\splunk\sep\db". Indexing has been paused. Will resume when free disk space rises above 1000MB."

I was hoping if there is a way of creating an email alert for this to make such incidents easier to track so I can get notified if this happens while I'm not logged onto splunk at the time.

Thanks

0 Karma
1 Solution

MuS
Legend

Hi kavraja,

If you're collecting WMI data you can build a search like this:

 sourcetype="WMI:FreeDiskSpace"  PercentFreeSpace<10 

Otherwise you will need to enable some WMI inputs and read this: Monitor WMI-based data
Once you got this search working, you can easily define an alert out of it.

hope this helps ...

cheers, MuS

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

If you're on a fairly recent version of Splunk you don't need to collect the data yourself, it's already there in the _introspection index:

index=_introspection component=Partitions | timechart min(data.free) by data.mount_point

kavraja
Path Finder

I'm on 6.0 but this index didn't seem to work. Thanks for the help though.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

It's been introduced in 6.1.0 😞

0 Karma

kavraja
Path Finder

Just my luck

0 Karma

MuS
Legend

Hi kavraja,

If you're collecting WMI data you can build a search like this:

 sourcetype="WMI:FreeDiskSpace"  PercentFreeSpace<10 

Otherwise you will need to enable some WMI inputs and read this: Monitor WMI-based data
Once you got this search working, you can easily define an alert out of it.

hope this helps ...

cheers, MuS

kavraja
Path Finder

Thanks for the help MuS. Works fine now

0 Karma

linu1988
Champion

Hello Kavraja,
This is kind of easy. Monitor your local server with Splunk and see when it closes to the limit. Run a alert in the same.

Thanks,
L

kavraja
Path Finder

Thanks for the help linu1988

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...