Hi Folks,
I can't see what would have caused the false alert to triggered: when I checked this directory I can see plenty of space :
Size: 500g Used: 9.6g Avail: 491g use%: 2%
the query looks like this:
index=a sourcetype=b MountedON="d" PercentUsedSpace > 90
| stats latest(PercentUsedSpace) as PercentUsedSpace latest(Avail) as Avail latest(Used) as Used latest(UsePct) as UsePct by MountedON
| fields MountedON UsePct Used Avail
| rename MountedON as "Mount" UsePct as "Percent Used" Used as "Used Space" Avail as "Available Space"
Hi @majilan1,
I have a number of alerts based on something similar and this is the search I use. The search doesn't look at the D drive but you can always add in mount="D:".
source="PerfmonMK:LogicalDisk" instance!= C: instance!=_Total %_Free_Space<10