How to setup splunk disk space alert(s) for multiple conditions in a single query ?

[rithwik572]

Hi,

Is it possible to setup alert for filesystem diskspace reaching threshold for 80%(alert should be triggered every 6 hrs), 85% ( alert should be triggered every 1 hr) and 90% alert should be triggered ( every 30 min)? I want 80% alert to be stopped when filesystem diskspace reaches 85% and similarly for 90% . I am not sure how to achieve this in splunk. Any suggestions ?

I can setup 3 individual alerts for 3 different thresholds but I am not sure how to achieve this in 1 alert query?

Thanks.

Thanks

[iamarkaprabha]

Hi ,

Why don't you try case statements for this one. If the cpu went up to 85% and more then it will store the data in one field and vice versa

using eval - eval description=case(status == 200, "OK", status ==404, "Not found", status == 500, "Internal Server Error")

http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/ConditionalFunctions#case.28X.2C.2...