Splunk Search

Search query to send alert when a filesystem percentage usage is greater than 90%

Isaias_Garcia
Path Finder

Hi-

I have the logs below in SPlunk. I wanted to create an alert when the UsePct is gretaer than 90%. Please help for the serach query that I will use to this. Thank you

Filesystem MountedOn Size UsePct
/dev/mapper/vg00-root / 9.9G 23%
/dev/sda1 /boot 92M 75%
/dev/mapper/vg00-var /var 4.8G 89%
/dev/mapper/vg00-tmp /tmp 2.0G 92%

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Add this to your existing search then set it up as a scheduled search that sends an email (or other alert) if there are results.

... | replace "*%" with "*" in UsePct | table Filesystem UsePct | where UsePct > 90
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Add this to your existing search then set it up as a scheduled search that sends an email (or other alert) if there are results.

... | replace "*%" with "*" in UsePct | table Filesystem UsePct | where UsePct > 90
---
If this reply helps you, Karma would be appreciated.

Isaias_Garcia
Path Finder

wow just wow!! it works!! thank you so much!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...