Solved: Re: How to setup an e-mail alert in Splunk App for...

sathiyasun · ‎01-26-2015

richgalloway · ‎01-26-2015

This should get you started on disk fillings. Set it up as a scheduled search that sends an email if there are results. Change the '85' to your own threshold value.

I don't have anything for memory spikes.

index="os" sourcetype="df" | multikv fields FileSystem, UsePct  | strcat host '@' Filesystem Drive| replace "*%" with "*" in UsePct | dedup Drive | table Drive IPAddress UsePct | where UsePct > 85

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎01-26-2015

This should get you started on disk fillings. Set it up as a scheduled search that sends an email if there are results. Change the '85' to your own threshold value.

I don't have anything for memory spikes.

index="os" sourcetype="df" | multikv fields FileSystem, UsePct  | strcat host '@' Filesystem Drive| replace "*%" with "*" in UsePct | dedup Drive | table Drive IPAddress UsePct | where UsePct > 85

---
If this reply helps you, Karma would be appreciated.

How to setup an e-mail alert in Splunk App for Unix and Linux for disk fillings and memory spike?

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

Data Persistence in the OpenTelemetry Collector

Thanks for the Memories! Splunk University, .conf25, and our Community

Are you a member of the Splunk Community?

How to setup an e-mail alert in Splunk App for Unix and Linux for disk fillings and memory spike?

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

Data Persistence in the OpenTelemetry Collector

Thanks for the Memories! Splunk University, .conf25, and our Community