Alerting

How to setup splunk disk space alert(s) for multiple conditions in a single query ?

rithwik572
Engager

Hi,

Is it possible to setup alert for filesystem diskspace reaching threshold for 80%(alert should be triggered every 6 hrs), 85% ( alert should be triggered every 1 hr) and 90% alert should be triggered ( every 30 min)? I want 80% alert to be stopped when filesystem diskspace reaches 85% and similarly for 90% . I am not sure how to achieve this in splunk. Any suggestions ?

I can setup 3 individual alerts for 3 different thresholds but I am not sure how to achieve this in 1 alert query?

Thanks.

Thanks

Tags (2)
0 Karma

iamarkaprabha
Contributor

Hi ,

Why don't you try case statements for this one. If the cpu went up to 85% and more then it will store the data in one field and vice versa

using eval - eval description=case(status == 200, "OK", status ==404, "Not found", status == 500, "Internal Server Error")

http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/ConditionalFunctions#case.28X.2C.2...

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...