How to setup splunk disk space alert(s) for multiple conditions in a single query ?



Is it possible to setup alert for filesystem diskspace reaching threshold for 80%(alert should be triggered every 6 hrs), 85% ( alert should be triggered every 1 hr) and 90% alert should be triggered ( every 30 min)? I want 80% alert to be stopped when filesystem diskspace reaches 85% and similarly for 90% . I am not sure how to achieve this in splunk. Any suggestions ?

I can setup 3 individual alerts for 3 different thresholds but I am not sure how to achieve this in 1 alert query?



Tags (2)
0 Karma


Hi ,

Why don't you try case statements for this one. If the cpu went up to 85% and more then it will store the data in one field and vice versa

using eval - eval description=case(status == 200, "OK", status ==404, "Not found", status == 500, "Internal Server Error")

Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...