Alerting

I want to get alert if the number goes behind the threshold

chandukreddi
Path Finder

I would like to get alert if it exceeds threshold

eg:

Datafsused >=50

Log print:

Mar 26 16:12:05 127.0.0.1 fs_used_percentage_stats: Datafsused=43 Commitlogfsused=21 Backupfsused=81

Tags (2)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

Check if Datafsused field is extracted in the index. If yes, then you can directly filter events in your search like this:

index=<index_name> Datafsused >= 50

If not use rex command to extract Datafsused values and then use where command:

index=<index_name> | rex "Datafsused=(?<Datafsused>\d+)" | where Datafsused >= 50

Then save this as an alert and add alert action settings: Add to Triggered Alerts.

View solution in original post

0 Karma

chandukreddi
Path Finder

Thanks for your quick help!

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Check if Datafsused field is extracted in the index. If yes, then you can directly filter events in your search like this:

index=<index_name> Datafsused >= 50

If not use rex command to extract Datafsused values and then use where command:

index=<index_name> | rex "Datafsused=(?<Datafsused>\d+)" | where Datafsused >= 50

Then save this as an alert and add alert action settings: Add to Triggered Alerts.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...