Alerting

How to setup splunk disk space alert(s) for multiple conditions in a single query ?

rithwik572
Engager

Hi,

Is it possible to setup alert for filesystem diskspace reaching threshold for 80%(alert should be triggered every 6 hrs), 85% ( alert should be triggered every 1 hr) and 90% alert should be triggered ( every 30 min)? I want 80% alert to be stopped when filesystem diskspace reaches 85% and similarly for 90% . I am not sure how to achieve this in splunk. Any suggestions ?

I can setup 3 individual alerts for 3 different thresholds but I am not sure how to achieve this in 1 alert query?

Thanks.

Thanks

Tags (2)
0 Karma

iamarkaprabha
Contributor

Hi ,

Why don't you try case statements for this one. If the cpu went up to 85% and more then it will store the data in one field and vice versa

using eval - eval description=case(status == 200, "OK", status ==404, "Not found", status == 500, "Internal Server Error")

http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/ConditionalFunctions#case.28X.2C.2...

Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...