Solved: How to setup an e-mail alert in Splunk App for Uni...

sathiyasun · ‎01-26-2015

richgalloway · ‎01-26-2015

This should get you started on disk fillings. Set it up as a scheduled search that sends an email if there are results. Change the '85' to your own threshold value.

I don't have anything for memory spikes.

index="os" sourcetype="df" | multikv fields FileSystem, UsePct  | strcat host '@' Filesystem Drive| replace "*%" with "*" in UsePct | dedup Drive | table Drive IPAddress UsePct | where UsePct > 85

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎01-26-2015

This should get you started on disk fillings. Set it up as a scheduled search that sends an email if there are results. Change the '85' to your own threshold value.

I don't have anything for memory spikes.

index="os" sourcetype="df" | multikv fields FileSystem, UsePct  | strcat host '@' Filesystem Drive| replace "*%" with "*" in UsePct | dedup Drive | table Drive IPAddress UsePct | where UsePct > 85

---
If this reply helps you, Karma would be appreciated.

How to setup an e-mail alert in Splunk App for Unix and Linux for disk fillings and memory spike?

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you a member of the Splunk Community?

How to setup an e-mail alert in Splunk App for Unix and Linux for disk fillings and memory spike?

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...