All Apps and Add-ons

How to setup an e-mail alert in Splunk App for Unix and Linux for disk fillings and memory spike?

sathiyasun
Explorer
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This should get you started on disk fillings. Set it up as a scheduled search that sends an email if there are results. Change the '85' to your own threshold value.

I don't have anything for memory spikes.

index="os" sourcetype="df" | multikv fields FileSystem, UsePct  | strcat host '@' Filesystem Drive| replace "*%" with "*" in UsePct | dedup Drive | table Drive IPAddress UsePct | where UsePct > 85
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

This should get you started on disk fillings. Set it up as a scheduled search that sends an email if there are results. Change the '85' to your own threshold value.

I don't have anything for memory spikes.

index="os" sourcetype="df" | multikv fields FileSystem, UsePct  | strcat host '@' Filesystem Drive| replace "*%" with "*" in UsePct | dedup Drive | table Drive IPAddress UsePct | where UsePct > 85
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!