Alerting

how to find out file systems are using more than 90% space in unix servers?

Path Finder

I ran below script, but it is not working.

sourcetype=df | multikv | dedup host,Filesystem | rex field=UsePct "(?\d+)" | where usage>50 | eval _raw="Filesystem "+Filesystem+" (mount point "+MountedOn+") on host "+host+" is "+UsePct+" full!" | fields - *
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Without a better explanation of "it is not working" it's hard to say exactly what is wrong, but I see a couple of problems with your search. Try this version:

sourcetype=df | multikv | dedup host,Filesystem | rex field=UsePct "(?<usage>\d+)" | where usage>50 | eval _raw="Filesystem "+Filesystem+" (mount point "+MountedOn+") on host "+host+" is "+UsePct+" full!" 
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

Without a better explanation of "it is not working" it's hard to say exactly what is wrong, but I see a couple of problems with your search. Try this version:

sourcetype=df | multikv | dedup host,Filesystem | rex field=UsePct "(?<usage>\d+)" | where usage>50 | eval _raw="Filesystem "+Filesystem+" (mount point "+MountedOn+") on host "+host+" is "+UsePct+" full!" 
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Path Finder

Thank you I got it now...

0 Karma