Why was the false alert triggered?

[majilan1]

Hi Folks,

I can't see what would have caused the false alert to triggered: when I checked this directory I can see plenty of space :

Size: 500g   Used: 9.6g   Avail: 491g  use%: 2%

the query looks like this:

index=a sourcetype=b  MountedON="d" PercentUsedSpace >  90

| stats latest(PercentUsedSpace) as PercentUsedSpace latest(Avail) as Avail latest(Used) as Used latest(UsePct) as UsePct by MountedON

| fields MountedON UsePct Used Avail

| rename MountedON as "Mount" UsePct as "Percent Used" Used as "Used Space" Avail as "Available Space"

[vishalduttauk]

Hi @majilan1,

I have a number of alerts based on something similar and this is the search I use. The search doesn't look at the D drive but you can always add in mount="D:".

source="PerfmonMK:LogicalDisk" instance!= C: instance!=_Total %_Free_Space<10