DMC alert for Disk usage

[rsathish47]

HI All,

We are receiving false alert in the DMC and checked the search it running following rest search . In that free and available diskspace having 100+ GB differents. How to fix it ?

| rest splunk_server_group=dmc_group_* /services/server/status/partitions-space

Output :
server  capacity  free  available 
idx10   2TB   188GB   83GB 

Thanks
Sathish Rangan

[mattymo]

Hi rsathish47!

The DMC alerts are configurable and can be set by navigating to the Platform Alerts Setup page.

You can then select the DMC Alert - Near Critical Disk Usage and configure the desired threshold.

The default threshold is 80%, which based on the output of that rest call, you have definitely breached.

Is the output you shared accurate when comparing to check from the indexer's cli?

[rsathish47]

Thank You mmodestino, we have configured for 97% in disk usage.

Different between free and available is too much. is there anywhere we can fix this?

[mattymo]

Ah! I see what you mean.

What version of Splunk are you running?

Also, try removing the wildcard from this search and hitting the endpoint for that indexer only.

| rest splunk_server=Idx10 /services/server/status/partitions-space

Is this the only Idx with this situation?

[rsathish47]

we are running on Splunk 6.4.1.
we run given rest call same out put
yep it is for only one index server