How we can configure disk space alert using Splunk . is it possible
could you please share the alert script or command
Start with this. Adjust the values as necessary. Have the alert trigger when the number of results is not zero.
index=<<index where your perfmon data is stored>> source=disk
| where storage_free_percent < <<your desired value>>
Yes, it is possible.
1) Install a Universal Forwarder (UF) on the Windows server
2) Enable the [perfmon://LogicalDisk] input on the UF. Restart the UF for the change to take effect.
3) Create an alert the triggers at the desired value of the % Free Space field.