Hello All,
I have set up the Splunk Add-On and Splunk App for Unix and Linux. Data is flowing properly however I am having an issue with alerts.
I am trying to set up alerts for various things to slack. I have the first alert on memory working. I set it to 1 min real-time and it seems to work just fine. This is the working query:
`os_index` source=vmstat | where max(memUsedPct) > 90 | stats max(memUsedPct) by host
However, when I try to do the same for disk, it does not work. I have tried expanding to 5min and 30min real-time windows but the only way I get data to show up in this query is by removing the where clause. I also tried using something like latest() instead of max() but that didn't help. What am I doing wrong here?
`os_index` source=df | where max(UsePct) > 10 | stats max(UsePct) by host
Thank you,
jackjack
