Alerting

Splunk Unix Add-On Alerts Troubleshooting

jackjack
Path Finder

Hello All,

I have set up the Splunk Add-On and Splunk App for Unix and Linux. Data is flowing properly however I am having an issue with alerts.

I am trying to set up alerts for various things to slack. I have the first alert on memory working. I set it to 1 min real-time and it seems to work just fine. This is the working query: 

 

`os_index` source=vmstat | where max(memUsedPct) > 90 | stats max(memUsedPct) by host

 

However, when I try to do the same for disk, it does not work. I have tried expanding to 5min and 30min real-time windows but the only way I get data to show up in this query is by removing the where clause. I also tried using something like latest() instead of max() but that didn't help. What am I doing wrong here?

 

`os_index` source=df | where max(UsePct) > 10 | stats max(UsePct) by host

 

Thank you,

jackjack

Labels (1)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!